~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~ [ freetext search ] ~ [ file search ] ~

Linux Cross Reference
Linux/drivers/block/cciss.c

Version: ~ [ 2.4.21-47.EL ] ~ [ 2.6.9-67.EL ] ~ [ 2.6.18-128.el5 ] ~ [ 2.6.18-164.el5 ] ~
Architecture: ~ [ i386 ] ~ [ x86_64 ] ~

  1 /*
  2  *    Disk Array driver for HP Smart Array Controllers
  3  *    Copyright 2000, 2008 Hewlett-Packard Development Company, L.P.
  4  *
  5  *    This program is free software; you can redistribute it and/or modify
  6  *    it under the terms of the GNU General Public License as published by
  7  *    the Free Software Foundation; version 2 of the License.
  8  *
  9  *    This program is distributed in the hope that it will be useful,
 10  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
 11  *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
 12  *    NON INFRINGEMENT.  See the GNU General Public License for more details.
 13  *
 14  *    You should have received a copy of the GNU General Public License
 15  *    along with this program; if not, write to the Free Software
 16  *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
 17  *    02111-1307, USA.
 18  *
 19  *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
 20  *
 21  */
 22 
 23 #include <linux/module.h>
 24 #include <linux/interrupt.h>
 25 #include <linux/types.h>
 26 #include <linux/pci.h>
 27 #include <linux/kernel.h>
 28 #include <linux/slab.h>
 29 #include <linux/delay.h>
 30 #include <linux/major.h>
 31 #include <linux/fs.h>
 32 #include <linux/bio.h>
 33 #include <linux/blkpg.h>
 34 #include <linux/timer.h>
 35 #include <linux/proc_fs.h>
 36 #include <linux/seq_file.h>
 37 #include <linux/init.h>
 38 #include <linux/hdreg.h>
 39 #include <linux/spinlock.h>
 40 #include <linux/compat.h>
 41 #include <linux/blktrace_api.h>
 42 #include <asm/uaccess.h>
 43 #include <asm/io.h>
 44 
 45 #include <linux/dma-mapping.h>
 46 #include <linux/blkdev.h>
 47 #include <linux/genhd.h>
 48 #include <linux/completion.h>
 49 #include <scsi/sg.h>
 50 #include <scsi/scsi_ioctl.h>
 51 #include <linux/cdrom.h>
 52 
 53 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
 54 #define DRIVER_NAME "HP CISS Driver (v 3.6.20-RH2)"
 55 #define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,20)
 56 
 57 /* Embedded module documentation macros - see modules.h */
 58 MODULE_AUTHOR("Hewlett-Packard Company");
 59 MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.20-RH2");
 60 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
 61                         " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
 62                         " and HP Smart Array G2 SAS/SATA Controllers");
 63 MODULE_VERSION("3.6.20-RH2");
 64 MODULE_LICENSE("GPL");
 65 
 66 #include "cciss_cmd.h"
 67 #include "cciss.h"
 68 #include <linux/cciss_ioctl.h>
 69 
 70 /* define the PCI info for the cards we can control */
 71 static const struct pci_device_id cciss_pci_device_id[] = {
 72         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
 73         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
 74         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
 75         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
 76         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
 77         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
 78         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
 79         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
 80         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
 81         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
 82         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
 83         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
 84         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
 85         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
 86         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
 87         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
 88         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
 89         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
 90         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
 91         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
 92         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
 93         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
 94         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
 95         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
 96         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
 97         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324A},
 98         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324B},
 99         {PCI_VENDOR_ID_HP,     PCI_ANY_ID,      PCI_ANY_ID, PCI_ANY_ID,
100                 PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
101         {0,}
102 };
103 
104 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
105 
106 /*  board_id = Subsystem Device ID & Vendor ID
107  *  product = Marketing Name for the board
108  *  access = Address of the struct of function pointers
109  */
110 static struct board_type products[] = {
111         {0x40700E11, "Smart Array 5300", &SA5_access},
112         {0x40800E11, "Smart Array 5i", &SA5B_access},
113         {0x40820E11, "Smart Array 532", &SA5B_access},
114         {0x40830E11, "Smart Array 5312", &SA5B_access},
115         {0x409A0E11, "Smart Array 641", &SA5_access},
116         {0x409B0E11, "Smart Array 642", &SA5_access},
117         {0x409C0E11, "Smart Array 6400", &SA5_access},
118         {0x409D0E11, "Smart Array 6400 EM", &SA5_access},
119         {0x40910E11, "Smart Array 6i", &SA5_access},
120         {0x3225103C, "Smart Array P600", &SA5_access},
121         {0x3223103C, "Smart Array P800", &SA5_access},
122         {0x3234103C, "Smart Array P400", &SA5_access},
123         {0x3235103C, "Smart Array P400i", &SA5_access},
124         {0x3211103C, "Smart Array E200i", &SA5_access},
125         {0x3212103C, "Smart Array E200", &SA5_access},
126         {0x3213103C, "Smart Array E200i", &SA5_access},
127         {0x3214103C, "Smart Array E200i", &SA5_access},
128         {0x3215103C, "Smart Array E200i", &SA5_access},
129         {0x3237103C, "Smart Array E500", &SA5_access},
130         {0x323D103C, "Smart Array P700m", &SA5_access},
131         {0x3241103C, "Smart Array P212", &SA5_access},
132         {0x3243103C, "Smart Array P410", &SA5_access},
133         {0x3245103C, "Smart Array P410i", &SA5_access},
134         {0x3247103C, "Smart Array P411", &SA5_access},
135         {0x3249103C, "Smart Array P812", &SA5_access},
136         {0x324A103C, "Smart Array P712m", &SA5_access},
137         {0x324B103C, "Smart Array P711m", &SA5_access},
138         {0xFFFF103C, "Unknown Smart Array", &SA5_access},
139 };
140 
141 /* How long to wait (in milliseconds) for board to go into simple mode */
142 #define MAX_CONFIG_WAIT 30000
143 #define MAX_IOCTL_CONFIG_WAIT 1000
144 
145 /*define how many times we will try a command because of bus resets */
146 #define MAX_CMD_RETRIES 3
147 
148 #define MAX_CTLR        32
149 
150 /* Originally cciss driver only supports 8 major numbers */
151 #define MAX_CTLR_ORIG   8
152 
153 static ctlr_info_t *hba[MAX_CTLR];
154 
155 static void do_cciss_request(request_queue_t *q);
156 static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs);
157 static int cciss_open(struct inode *inode, struct file *filep);
158 static int cciss_release(struct inode *inode, struct file *filep);
159 static int cciss_ioctl(struct inode *inode, struct file *filep,
160                        unsigned int cmd, unsigned long arg);
161 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
162 
163 static int cciss_revalidate(struct gendisk *disk);
164 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk);
165 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
166                            int clear_all);
167 static void cciss_read_capacity(int ctlr, int logvol, int withirq,
168                         sector_t *total_size, unsigned int *block_size);
169 static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
170                         sector_t *total_size, unsigned int *block_size);
171 static void cciss_geometry_inquiry(int ctlr, int logvol, int withirq,
172                         sector_t total_size, unsigned int block_size,
173                         InquiryData_struct *inq_buff,
174                         drive_info_struct *drv);
175 static void cciss_getgeometry(int cntl_num);
176 static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
177                                            __u32);
178 static void start_io(ctlr_info_t *h);
179 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
180                    unsigned int use_unit_num, unsigned int log_unit,
181                    __u8 page_code, unsigned char *scsi3addr, int cmd_type);
182 static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
183                            unsigned int use_unit_num, unsigned int log_unit,
184                            __u8 page_code, int cmd_type);
185 
186 static void fail_all_cmds(unsigned long ctlr);
187 static void cciss_shutdown(struct pci_dev *);
188 
189 #ifdef CONFIG_PROC_FS
190 static void cciss_procinit(int i);
191 #else
192 static void cciss_procinit(int i)
193 {
194 }
195 #endif                          /* CONFIG_PROC_FS */
196 
197 #ifdef CONFIG_COMPAT
198 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg);
199 #endif
200 
201 static struct block_device_operations cciss_fops = {
202         .owner = THIS_MODULE,
203         .open = cciss_open,
204         .release = cciss_release,
205         .ioctl = cciss_ioctl,
206         .getgeo = cciss_getgeo,
207 #ifdef CONFIG_COMPAT
208         .compat_ioctl = cciss_compat_ioctl,
209 #endif
210         .revalidate_disk = cciss_revalidate,
211 };
212 
213 /*
214  * Enqueuing and dequeuing functions for cmdlists.
215  */
216 static inline void addQ(CommandList_struct **Qptr, CommandList_struct *c)
217 {
218         if (*Qptr == NULL) {
219                 *Qptr = c;
220                 c->next = c->prev = c;
221         } else {
222                 c->prev = (*Qptr)->prev;
223                 c->next = (*Qptr);
224                 (*Qptr)->prev->next = c;
225                 (*Qptr)->prev = c;
226         }
227 }
228 
229 static inline CommandList_struct *removeQ(CommandList_struct **Qptr,
230                                           CommandList_struct *c)
231 {
232         if (c && c->next != c) {
233                 if (*Qptr == c)
234                         *Qptr = c->next;
235                 c->prev->next = c->next;
236                 c->next->prev = c->prev;
237         } else {
238                 *Qptr = NULL;
239         }
240         return c;
241 }
242 
243 #include "cciss_scsi.c"         /* For SCSI tape support */
244 
245 #ifdef CONFIG_PROC_FS
246 
247 /*
248  * Report information about this controller.
249  */
250 #define ENG_GIG 1000000000
251 #define ENG_GIG_FACTOR (ENG_GIG/512)
252 #define RAID_UNKNOWN 6
253 #define ENGAGE_SCSI     "engage scsi"
254 static const char *raid_label[] = { "", "4", "1(1+0)", "5", "5+1", "ADG",
255         "UNKNOWN"
256 };
257 
258 static struct proc_dir_entry *proc_cciss;
259 
260 static void cciss_seq_show_header(struct seq_file *seq)
261 {
262         ctlr_info_t *h = seq->private;
263 
264         seq_printf(seq, "%s: HP %s Controller\n"
265                 "Board ID: 0x%08lx\n"
266                 "Firmware Version: %c%c%c%c\n"
267                 "IRQ: %d\n"
268                 "Logical drives: %d\n"
269                 "Sector size: %d\n"
270                 "Current Q depth: %d\n"
271                 "Current # commands on controller: %d\n"
272                 "Max Q depth since init: %d\n"
273                 "Max # commands on controller since init: %d\n"
274                 "Max SG entries since init: %d\n",
275                 h->devname,
276                 h->product_name,
277                 (unsigned long)h->board_id,
278                 h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
279                 h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
280                 h->num_luns,
281                 h->cciss_sector_size,
282                 h->Qdepth, h->commands_outstanding,
283                 h->maxQsinceinit, h->max_outstanding, h->maxSG);
284 
285         cciss_seq_tape_report (seq, h->ctlr);
286 }
287 
288 static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
289 {
290         ctlr_info_t *h = seq->private;
291         unsigned ctlr = h->ctlr;
292         unsigned long flags;
293 
294         /* prevent displaying bogus info during configuration
295          * or deconfiguration of a logical volume
296          */
297         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
298         if (h->busy_configuring) {
299                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
300                 return ERR_PTR(-EBUSY);
301         }
302         h->busy_configuring = 1;
303         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
304 
305         if (*pos == 0)
306                 cciss_seq_show_header(seq);
307 
308         return pos;
309 }
310 
311 static int cciss_seq_show(struct seq_file *seq, void *v)
312 {
313         sector_t vol_sz, vol_sz_frac;
314         ctlr_info_t *h = seq->private;
315         unsigned ctlr = h->ctlr;
316         loff_t *pos = v;
317         drive_info_struct *drv = &h->drv[*pos];
318 
319         if (*pos > h->highest_lun)
320                 return 0;
321 
322         if (drv->heads == 0)
323                 return 0;
324 
325         vol_sz = drv->nr_blocks;
326         vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
327         vol_sz_frac *= 100;
328         sector_div(vol_sz_frac, ENG_GIG_FACTOR);
329 
330         if (drv->raid_level > 5)
331                 drv->raid_level = RAID_UNKNOWN;
332         seq_printf(seq, "cciss/c%dd%d:"
333                         "\t%4u.%02uGB\tRAID %s\n",
334                         ctlr, (int)*pos, (int)vol_sz, (int)vol_sz_frac,
335                         raid_label[drv->raid_level]);
336 
337         return 0;
338 }
339 
340 static void *cciss_seq_next(struct seq_file *seq, void *v, loff_t *pos)
341 {
342         ctlr_info_t *h = seq->private;
343 
344         if (*pos > h->highest_lun)
345                 return NULL;
346         *pos += 1;
347 
348         return pos;
349 }
350 
351 static void cciss_seq_stop(struct seq_file *seq, void *v)
352 {
353         ctlr_info_t *h = seq->private;
354 
355         /* Only reset h->busy_configuring if we succeeded in setting
356          * it during cciss_seq_start. */
357         if (v == ERR_PTR(-EBUSY))
358                 return;
359 
360         h->busy_configuring = 0;
361 }
362 
363 static struct seq_operations cciss_seq_ops = {
364         .start = cciss_seq_start,
365         .show  = cciss_seq_show,
366         .next  = cciss_seq_next,
367         .stop  = cciss_seq_stop,
368 };
369 
370 static int cciss_seq_open(struct inode *inode, struct file *file)
371 {
372         int ret = seq_open(file, &cciss_seq_ops);
373         struct seq_file *seq = file->private_data;
374 
375         if (!ret)
376                 seq->private = PDE(inode)->data;
377 
378         return ret;
379 }
380 
381 static ssize_t
382 cciss_proc_write(struct file *file, const char __user *buf,
383                  size_t length, loff_t *ppos)
384 {
385         struct seq_file *seq = file->private_data;
386         ctlr_info_t *h = seq->private;
387         int err, rc;
388         char *buffer;
389 
390 
391 #ifndef CONFIG_CISS_SCSI_TAPE
392         return -EINVAL;
393 #endif
394 
395         if (!buf || length > PAGE_SIZE - 1)
396                 return -EINVAL;
397 
398         buffer = (char *)__get_free_page(GFP_KERNEL);
399         if (!buffer)
400                 return -ENOMEM;
401 
402         err = -EFAULT;
403         if (copy_from_user(buffer, buf, length))
404                 goto out;
405         buffer[length] = '\0';
406 
407         if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
408                 rc = cciss_engage_scsi(h->ctlr);
409                 if (rc != 0)
410                         err = -rc;
411                 else
412                         err = length;
413         }
414         else 
415                 err = -EINVAL;
416         /* might be nice to have "disengage" too, but it's not
417            safely possible. (only 1 module use count, lock issues.) */
418 
419  out:
420         free_page((unsigned long)buffer);
421         return err;
422 }
423 
424 static struct file_operations cciss_proc_fops = {
425         .owner   = THIS_MODULE,
426         .open    = cciss_seq_open,
427         .read    = seq_read,
428         .llseek  = seq_lseek,
429         .release = seq_release,
430         .write   = cciss_proc_write,
431 };
432 
433 static void __devinit cciss_procinit(int i)
434 {
435         struct proc_dir_entry *pde;
436 
437         if (proc_cciss == NULL)
438                 proc_cciss = proc_mkdir("cciss", proc_root_driver);
439         if (!proc_cciss)
440                 return;
441 
442         pde = create_proc_entry(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH, proc_cciss);
443         if (!pde)
444                 return;
445 
446         pde->proc_fops = &cciss_proc_fops;
447         pde->data = hba[i];
448 }
449 #endif                          /* CONFIG_PROC_FS */
450 
451 /*
452  * For operations that cannot sleep, a command block is allocated at init,
453  * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
454  * which ones are free or in use.  For operations that can wait for kmalloc
455  * to possible sleep, this routine can be called with get_from_pool set to 0.
456  * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
457  */
458 static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
459 {
460         CommandList_struct *c;
461         int i;
462         u64bit temp64;
463         dma_addr_t cmd_dma_handle, err_dma_handle;
464 
465         if (!get_from_pool) {
466                 c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
467                         sizeof(CommandList_struct), &cmd_dma_handle);
468                 if (c == NULL)
469                         return NULL;
470                 memset(c, 0, sizeof(CommandList_struct));
471 
472                 c->cmdindex = -1;
473 
474                 c->err_info = (ErrorInfo_struct *)
475                     pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
476                             &err_dma_handle);
477 
478                 if (c->err_info == NULL) {
479                         pci_free_consistent(h->pdev,
480                                 sizeof(CommandList_struct), c, cmd_dma_handle);
481                         return NULL;
482                 }
483                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
484         } else {                /* get it out of the controllers pool */
485 
486                 do {
487                         i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
488                         if (i == h->nr_cmds)
489                                 return NULL;
490                 } while (test_and_set_bit
491                          (i & (BITS_PER_LONG - 1),
492                           h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
493 #ifdef CCISS_DEBUG
494                 printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
495 #endif
496                 c = h->cmd_pool + i;
497                 memset(c, 0, sizeof(CommandList_struct));
498                 cmd_dma_handle = h->cmd_pool_dhandle
499                     + i * sizeof(CommandList_struct);
500                 c->err_info = h->errinfo_pool + i;
501                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
502                 err_dma_handle = h->errinfo_pool_dhandle
503                     + i * sizeof(ErrorInfo_struct);
504                 h->nr_allocs++;
505 
506                 c->cmdindex = i;
507         }
508 
509         c->busaddr = (__u32) cmd_dma_handle;
510         temp64.val = (__u64) err_dma_handle;
511         c->ErrDesc.Addr.lower = temp64.val32.lower;
512         c->ErrDesc.Addr.upper = temp64.val32.upper;
513         c->ErrDesc.Len = sizeof(ErrorInfo_struct);
514 
515         c->ctlr = h->ctlr;
516         return c;
517 }
518 
519 /*
520  * Frees a command block that was previously allocated with cmd_alloc().
521  */
522 static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
523 {
524         int i;
525         u64bit temp64;
526 
527         if (!got_from_pool) {
528                 temp64.val32.lower = c->ErrDesc.Addr.lower;
529                 temp64.val32.upper = c->ErrDesc.Addr.upper;
530                 pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
531                                     c->err_info, (dma_addr_t) temp64.val);
532                 pci_free_consistent(h->pdev, sizeof(CommandList_struct),
533                                     c, (dma_addr_t) c->busaddr);
534         } else {
535                 i = c - h->cmd_pool;
536                 clear_bit(i & (BITS_PER_LONG - 1),
537                           h->cmd_pool_bits + (i / BITS_PER_LONG));
538                 h->nr_frees++;
539         }
540 }
541 
542 static inline ctlr_info_t *get_host(struct gendisk *disk)
543 {
544         return disk->queue->queuedata;
545 }
546 
547 static inline drive_info_struct *get_drv(struct gendisk *disk)
548 {
549         return disk->private_data;
550 }
551 
552 /*
553  * Open.  Make sure the device is really there.
554  */
555 static int cciss_open(struct inode *inode, struct file *filep)
556 {
557         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
558         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
559 
560 #ifdef CCISS_DEBUG
561         printk(KERN_DEBUG "cciss_open %s\n", inode->i_bdev->bd_disk->disk_name);
562 #endif                          /* CCISS_DEBUG */
563 
564         if (host->busy_initializing || drv->busy_configuring)
565                 return -EBUSY;
566         /*
567          * Root is allowed to open raw volume zero even if it's not configured
568          * so array config can still work. Root is also allowed to open any
569          * volume that has a LUN ID, so it can issue IOCTL to reread the
570          * disk information.  I don't think I really like this
571          * but I'm already using way to many device nodes to claim another one
572          * for "raw controller".
573          */
574         if (drv->heads == 0) {
575                 if (iminor(inode) != 0) {       /* not node 0? */
576                         /* if not node 0 make sure it is a partition = 0 */
577                         if (iminor(inode) & 0x0f) {
578                                 return -ENXIO;
579                                 /* if it is, make sure we have a LUN ID */
580                         } else if (drv->LunID == 0) {
581                                 return -ENXIO;
582                         }
583                 }
584                 if (!capable(CAP_SYS_ADMIN))
585                         return -EPERM;
586         }
587         drv->usage_count++;
588         host->usage_count++;
589         return 0;
590 }
591 
592 /*
593  * Close.  Sync first.
594  */
595 static int cciss_release(struct inode *inode, struct file *filep)
596 {
597         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
598         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
599 
600 #ifdef CCISS_DEBUG
601         printk(KERN_DEBUG "cciss_release %s\n",
602                inode->i_bdev->bd_disk->disk_name);
603 #endif                          /* CCISS_DEBUG */
604 
605         drv->usage_count--;
606         host->usage_count--;
607         return 0;
608 }
609 
610 #ifdef CONFIG_COMPAT
611 
612 static int do_ioctl(struct file *f, unsigned cmd, unsigned long arg)
613 {
614         int ret;
615         lock_kernel();
616         ret = cciss_ioctl(f->f_dentry->d_inode, f, cmd, arg);
617         unlock_kernel();
618         return ret;
619 }
620 
621 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
622                                   unsigned long arg);
623 static int cciss_ioctl32_big_passthru(struct file *f, unsigned cmd,
624                                       unsigned long arg);
625 
626 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg)
627 {
628         switch (cmd) {
629         case CCISS_GETPCIINFO:
630         case CCISS_GETINTINFO:
631         case CCISS_SETINTINFO:
632         case CCISS_GETNODENAME:
633         case CCISS_SETNODENAME:
634         case CCISS_GETHEARTBEAT:
635         case CCISS_GETBUSTYPES:
636         case CCISS_GETFIRMVER:
637         case CCISS_GETDRIVVER:
638         case CCISS_REVALIDVOLS:
639         case CCISS_DEREGDISK:
640         case CCISS_REGNEWDISK:
641         case CCISS_REGNEWD:
642         case CCISS_RESCANDISK:
643         case CCISS_GETLUNINFO:
644                 return do_ioctl(f, cmd, arg);
645 
646         case CCISS_PASSTHRU32:
647                 return cciss_ioctl32_passthru(f, cmd, arg);
648         case CCISS_BIG_PASSTHRU32:
649                 return cciss_ioctl32_big_passthru(f, cmd, arg);
650 
651         default:
652                 return -ENOIOCTLCMD;
653         }
654 }
655 
656 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
657                                   unsigned long arg)
658 {
659         IOCTL32_Command_struct __user *arg32 =
660             (IOCTL32_Command_struct __user *) arg;
661         IOCTL_Command_struct arg64;
662         IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
663         int err;
664         u32 cp;
665 
666         err = 0;
667         err |=
668             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
669                            sizeof(arg64.LUN_info));
670         err |=
671             copy_from_user(&arg64.Request, &arg32->Request,
672                            sizeof(arg64.Request));
673         err |=
674             copy_from_user(&arg64.error_info, &arg32->error_info,
675                            sizeof(arg64.error_info));
676         err |= get_user(arg64.buf_size, &arg32->buf_size);
677         err |= get_user(cp, &arg32->buf);
678         arg64.buf = compat_ptr(cp);
679         err |= copy_to_user(p, &arg64, sizeof(arg64));
680 
681         if (err)
682                 return -EFAULT;
683 
684         err = do_ioctl(f, CCISS_PASSTHRU, (unsigned long)p);
685         if (err)
686                 return err;
687         err |=
688             copy_in_user(&arg32->error_info, &p->error_info,
689                          sizeof(arg32->error_info));
690         if (err)
691                 return -EFAULT;
692         return err;
693 }
694 
695 static int cciss_ioctl32_big_passthru(struct file *file, unsigned cmd,
696                                       unsigned long arg)
697 {
698         BIG_IOCTL32_Command_struct __user *arg32 =
699             (BIG_IOCTL32_Command_struct __user *) arg;
700         BIG_IOCTL_Command_struct arg64;
701         BIG_IOCTL_Command_struct __user *p =
702             compat_alloc_user_space(sizeof(arg64));
703         int err;
704         u32 cp;
705 
706         err = 0;
707         err |=
708             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
709                            sizeof(arg64.LUN_info));
710         err |=
711             copy_from_user(&arg64.Request, &arg32->Request,
712                            sizeof(arg64.Request));
713         err |=
714             copy_from_user(&arg64.error_info, &arg32->error_info,
715                            sizeof(arg64.error_info));
716         err |= get_user(arg64.buf_size, &arg32->buf_size);
717         err |= get_user(arg64.malloc_size, &arg32->malloc_size);
718         err |= get_user(cp, &arg32->buf);
719         arg64.buf = compat_ptr(cp);
720         err |= copy_to_user(p, &arg64, sizeof(arg64));
721 
722         if (err)
723                 return -EFAULT;
724 
725         err = do_ioctl(file, CCISS_BIG_PASSTHRU, (unsigned long)p);
726         if (err)
727                 return err;
728         err |=
729             copy_in_user(&arg32->error_info, &p->error_info,
730                          sizeof(arg32->error_info));
731         if (err)
732                 return -EFAULT;
733         return err;
734 }
735 #endif
736 
737 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
738 {
739         drive_info_struct *drv = get_drv(bdev->bd_disk);
740 
741         if (!drv->cylinders)
742                 return -ENXIO;
743 
744         geo->heads = drv->heads;
745         geo->sectors = drv->sectors;
746         geo->cylinders = drv->cylinders;
747         return 0;
748 }
749 
750 /*
751  * ioctl
752  */
753 static int cciss_ioctl(struct inode *inode, struct file *filep,
754                        unsigned int cmd, unsigned long arg)
755 {
756         struct block_device *bdev = inode->i_bdev;
757         struct gendisk *disk = bdev->bd_disk;
758         ctlr_info_t *host = get_host(disk);
759         drive_info_struct *drv = get_drv(disk);
760         int ctlr = host->ctlr;
761         void __user *argp = (void __user *)arg;
762 
763 #ifdef CCISS_DEBUG
764         printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
765 #endif                          /* CCISS_DEBUG */
766 
767         switch (cmd) {
768         case CCISS_GETPCIINFO:
769                 {
770                         cciss_pci_info_struct pciinfo;
771 
772                         if (!arg)
773                                 return -EINVAL;
774                         pciinfo.domain = pci_domain_nr(host->pdev->bus);
775                         pciinfo.bus = host->pdev->bus->number;
776                         pciinfo.dev_fn = host->pdev->devfn;
777                         pciinfo.board_id = host->board_id;
778                         if (copy_to_user
779                             (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
780                                 return -EFAULT;
781                         return 0;
782                 }
783         case CCISS_GETINTINFO:
784                 {
785                         cciss_coalint_struct intinfo;
786                         if (!arg)
787                                 return -EINVAL;
788                         intinfo.delay =
789                             readl(&host->cfgtable->HostWrite.CoalIntDelay);
790                         intinfo.count =
791                             readl(&host->cfgtable->HostWrite.CoalIntCount);
792                         if (copy_to_user
793                             (argp, &intinfo, sizeof(cciss_coalint_struct)))
794                                 return -EFAULT;
795                         return 0;
796                 }
797         case CCISS_SETINTINFO:
798                 {
799                         cciss_coalint_struct intinfo;
800                         unsigned long flags;
801                         int i;
802 
803                         if (!arg)
804                                 return -EINVAL;
805                         if (!capable(CAP_SYS_ADMIN))
806                                 return -EPERM;
807                         if (copy_from_user
808                             (&intinfo, argp, sizeof(cciss_coalint_struct)))
809                                 return -EFAULT;
810                         if ((intinfo.delay == 0) && (intinfo.count == 0))
811                         {
812 //                      printk("cciss_ioctl: delay and count cannot be 0\n");
813                                 return -EINVAL;
814                         }
815                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
816                         /* Update the field, and then ring the doorbell */
817                         writel(intinfo.delay,
818                                &(host->cfgtable->HostWrite.CoalIntDelay));
819                         writel(intinfo.count,
820                                &(host->cfgtable->HostWrite.CoalIntCount));
821                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
822 
823                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
824                                 if (!(readl(host->vaddr + SA5_DOORBELL)
825                                       & CFGTBL_ChangeReq))
826                                         break;
827                                 /* delay and try again */
828                                 udelay(1000);
829                         }
830                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
831                         if (i >= MAX_IOCTL_CONFIG_WAIT)
832                                 return -EAGAIN;
833                         return 0;
834                 }
835         case CCISS_GETNODENAME:
836                 {
837                         NodeName_type NodeName;
838                         int i;
839 
840                         if (!arg)
841                                 return -EINVAL;
842                         for (i = 0; i < 16; i++)
843                                 NodeName[i] =
844                                     readb(&host->cfgtable->ServerName[i]);
845                         if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
846                                 return -EFAULT;
847                         return 0;
848                 }
849         case CCISS_SETNODENAME:
850                 {
851                         NodeName_type NodeName;
852                         unsigned long flags;
853                         int i;
854 
855                         if (!arg)
856                                 return -EINVAL;
857                         if (!capable(CAP_SYS_ADMIN))
858                                 return -EPERM;
859 
860                         if (copy_from_user
861                             (NodeName, argp, sizeof(NodeName_type)))
862                                 return -EFAULT;
863 
864                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
865 
866                         /* Update the field, and then ring the doorbell */
867                         for (i = 0; i < 16; i++)
868                                 writeb(NodeName[i],
869                                        &host->cfgtable->ServerName[i]);
870 
871                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
872 
873                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
874                                 if (!(readl(host->vaddr + SA5_DOORBELL)
875                                       & CFGTBL_ChangeReq))
876                                         break;
877                                 /* delay and try again */
878                                 udelay(1000);
879                         }
880                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
881                         if (i >= MAX_IOCTL_CONFIG_WAIT)
882                                 return -EAGAIN;
883                         return 0;
884                 }
885 
886         case CCISS_GETHEARTBEAT:
887                 {
888                         Heartbeat_type heartbeat;
889 
890                         if (!arg)
891                                 return -EINVAL;
892                         heartbeat = readl(&host->cfgtable->HeartBeat);
893                         if (copy_to_user
894                             (argp, &heartbeat, sizeof(Heartbeat_type)))
895                                 return -EFAULT;
896                         return 0;
897                 }
898         case CCISS_GETBUSTYPES:
899                 {
900                         BusTypes_type BusTypes;
901 
902                         if (!arg)
903                                 return -EINVAL;
904                         BusTypes = readl(&host->cfgtable->BusTypes);
905                         if (copy_to_user
906                             (argp, &BusTypes, sizeof(BusTypes_type)))
907                                 return -EFAULT;
908                         return 0;
909                 }
910         case CCISS_GETFIRMVER:
911                 {
912                         FirmwareVer_type firmware;
913 
914                         if (!arg)
915                                 return -EINVAL;
916                         memcpy(firmware, host->firm_ver, 4);
917 
918                         if (copy_to_user
919                             (argp, firmware, sizeof(FirmwareVer_type)))
920                                 return -EFAULT;
921                         return 0;
922                 }
923         case CCISS_GETDRIVVER:
924                 {
925                         DriverVer_type DriverVer = DRIVER_VERSION;
926 
927                         if (!arg)
928                                 return -EINVAL;
929 
930                         if (copy_to_user
931                             (argp, &DriverVer, sizeof(DriverVer_type)))
932                                 return -EFAULT;
933                         return 0;
934                 }
935 
936         case CCISS_REVALIDVOLS:
937                 return rebuild_lun_table(host, NULL);
938 
939         case CCISS_GETLUNINFO:{
940                         LogvolInfo_struct luninfo;
941 
942                         luninfo.LunID = drv->LunID;
943                         luninfo.num_opens = drv->usage_count;
944                         luninfo.num_parts = 0;
945                         if (copy_to_user(argp, &luninfo,
946                                          sizeof(LogvolInfo_struct)))
947                                 return -EFAULT;
948                         return 0;
949                 }
950         case CCISS_DEREGDISK:
951                 return rebuild_lun_table(host, disk);
952 
953         case CCISS_REGNEWD:
954                 return rebuild_lun_table(host, NULL);
955 
956         case CCISS_PASSTHRU:
957                 {
958                         IOCTL_Command_struct iocommand;
959                         CommandList_struct *c;
960                         char *buff = NULL;
961                         u64bit temp64;
962                         unsigned long flags;
963                         DECLARE_COMPLETION_ONSTACK(wait);
964 
965                         if (!arg)
966                                 return -EINVAL;
967 
968                         if (!capable(CAP_SYS_RAWIO))
969                                 return -EPERM;
970 
971                         if (copy_from_user
972                             (&iocommand, argp, sizeof(IOCTL_Command_struct)))
973                                 return -EFAULT;
974                         if ((iocommand.buf_size < 1) &&
975                             (iocommand.Request.Type.Direction != XFER_NONE)) {
976                                 return -EINVAL;
977                         }
978 #if 0                           /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
979                         /* Check kmalloc limits */
980                         if (iocommand.buf_size > 128000)
981                                 return -EINVAL;
982 #endif
983                         if (iocommand.buf_size > 0) {
984                                 buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
985                                 if (buff == NULL)
986                                         return -EFAULT;
987                         }
988                         if (iocommand.Request.Type.Direction == XFER_WRITE) {
989                                 /* Copy the data into the buffer we created */
990                                 if (copy_from_user
991                                     (buff, iocommand.buf, iocommand.buf_size)) {
992                                         kfree(buff);
993                                         return -EFAULT;
994                                 }
995                         } else {
996                                 memset(buff, 0, iocommand.buf_size);
997                         }
998                         if ((c = cmd_alloc(host, 0)) == NULL) {
999                                 kfree(buff);
1000                                 return -ENOMEM;
1001                         }
1002                         // Fill in the command type
1003                         c->cmd_type = CMD_IOCTL_PEND;
1004                         // Fill in Command Header
1005                         c->Header.ReplyQueue = 0;       // unused in simple mode
1006                         if (iocommand.buf_size > 0)     // buffer to fill
1007                         {
1008                                 c->Header.SGList = 1;
1009                                 c->Header.SGTotal = 1;
1010                         } else  // no buffers to fill
1011                         {
1012                                 c->Header.SGList = 0;
1013                                 c->Header.SGTotal = 0;
1014                         }
1015                         c->Header.LUN = iocommand.LUN_info;
1016                         c->Header.Tag.lower = c->busaddr;       // use the kernel address the cmd block for tag
1017 
1018                         // Fill in Request block
1019                         c->Request = iocommand.Request;
1020 
1021                         // Fill in the scatter gather information
1022                         if (iocommand.buf_size > 0) {
1023                                 temp64.val = pci_map_single(host->pdev, buff,
1024                                         iocommand.buf_size,
1025                                         PCI_DMA_BIDIRECTIONAL);
1026                                 c->SG[0].Addr.lower = temp64.val32.lower;
1027                                 c->SG[0].Addr.upper = temp64.val32.upper;
1028                                 c->SG[0].Len = iocommand.buf_size;
1029                                 c->SG[0].Ext = 0;       // we are not chaining
1030                         }
1031                         c->waiting = &wait;
1032 
1033                         /* Put the request on the tail of the request queue */
1034                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1035                         addQ(&host->reqQ, c);
1036                         host->Qdepth++;
1037                         start_io(host);
1038                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1039 
1040                         wait_for_completion(&wait);
1041 
1042                         /* unlock the buffers from DMA */
1043                         temp64.val32.lower = c->SG[0].Addr.lower;
1044                         temp64.val32.upper = c->SG[0].Addr.upper;
1045                         pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
1046                                          iocommand.buf_size,
1047                                          PCI_DMA_BIDIRECTIONAL);
1048 
1049                         /* Copy the error information out */
1050                         iocommand.error_info = *(c->err_info);
1051                         if (copy_to_user
1052                             (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
1053                                 kfree(buff);
1054                                 cmd_free(host, c, 0);
1055                                 return -EFAULT;
1056                         }
1057 
1058                         if (iocommand.Request.Type.Direction == XFER_READ) {
1059                                 /* Copy the data out of the buffer we created */
1060                                 if (copy_to_user
1061                                     (iocommand.buf, buff, iocommand.buf_size)) {
1062                                         kfree(buff);
1063                                         cmd_free(host, c, 0);
1064                                         return -EFAULT;
1065                                 }
1066                         }
1067                         kfree(buff);
1068                         cmd_free(host, c, 0);
1069                         return 0;
1070                 }
1071         case CCISS_BIG_PASSTHRU:{
1072                         BIG_IOCTL_Command_struct *ioc;
1073                         CommandList_struct *c;
1074                         unsigned char **buff = NULL;
1075                         int *buff_size = NULL;
1076                         u64bit temp64;
1077                         unsigned long flags;
1078                         BYTE sg_used = 0;
1079                         int status = 0;
1080                         int i;
1081                         DECLARE_COMPLETION_ONSTACK(wait);
1082                         __u32 left;
1083                         __u32 sz;
1084                         BYTE __user *data_ptr;
1085 
1086                         if (!arg)
1087                                 return -EINVAL;
1088                         if (!capable(CAP_SYS_RAWIO))
1089                                 return -EPERM;
1090                         ioc = (BIG_IOCTL_Command_struct *)
1091                             kmalloc(sizeof(*ioc), GFP_KERNEL);
1092                         if (!ioc) {
1093                                 status = -ENOMEM;
1094                                 goto cleanup1;
1095                         }
1096                         if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1097                                 status = -EFAULT;
1098                                 goto cleanup1;
1099                         }
1100                         if ((ioc->buf_size < 1) &&
1101                             (ioc->Request.Type.Direction != XFER_NONE)) {
1102                                 status = -EINVAL;
1103                                 goto cleanup1;
1104                         }
1105                         /* Check kmalloc limits  using all SGs */
1106                         if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1107                                 status = -EINVAL;
1108                                 goto cleanup1;
1109                         }
1110                         if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1111                                 status = -EINVAL;
1112                                 goto cleanup1;
1113                         }
1114                         buff =
1115                             kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1116                         if (!buff) {
1117                                 status = -ENOMEM;
1118                                 goto cleanup1;
1119                         }
1120                         buff_size = (int *)kmalloc(MAXSGENTRIES * sizeof(int),
1121                                                    GFP_KERNEL);
1122                         if (!buff_size) {
1123                                 status = -ENOMEM;
1124                                 goto cleanup1;
1125                         }
1126                         left = ioc->buf_size;
1127                         data_ptr = ioc->buf;
1128                         while (left) {
1129                                 sz = (left >
1130                                       ioc->malloc_size) ? ioc->
1131                                     malloc_size : left;
1132                                 buff_size[sg_used] = sz;
1133                                 buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1134                                 if (buff[sg_used] == NULL) {
1135                                         status = -ENOMEM;
1136                                         goto cleanup1;
1137                                 }
1138                                 if (ioc->Request.Type.Direction == XFER_WRITE) {
1139                                         if (copy_from_user
1140                                             (buff[sg_used], data_ptr, sz)) {
1141                                                 status = -ENOMEM;
1142                                                 goto cleanup1;
1143                                         }
1144                                 } else {
1145                                         memset(buff[sg_used], 0, sz);
1146                                 }
1147                                 left -= sz;
1148                                 data_ptr += sz;
1149                                 sg_used++;
1150                         }
1151                         if ((c = cmd_alloc(host, 0)) == NULL) {
1152                                 status = -ENOMEM;
1153                                 goto cleanup1;
1154                         }
1155                         c->cmd_type = CMD_IOCTL_PEND;
1156                         c->Header.ReplyQueue = 0;
1157 
1158                         if (ioc->buf_size > 0) {
1159                                 c->Header.SGList = sg_used;
1160                                 c->Header.SGTotal = sg_used;
1161                         } else {
1162                                 c->Header.SGList = 0;
1163                                 c->Header.SGTotal = 0;
1164                         }
1165                         c->Header.LUN = ioc->LUN_info;
1166                         c->Header.Tag.lower = c->busaddr;
1167 
1168                         c->Request = ioc->Request;
1169                         if (ioc->buf_size > 0) {
1170                                 int i;
1171                                 for (i = 0; i < sg_used; i++) {
1172                                         temp64.val =
1173                                             pci_map_single(host->pdev, buff[i],
1174                                                     buff_size[i],
1175                                                     PCI_DMA_BIDIRECTIONAL);
1176                                         c->SG[i].Addr.lower =
1177                                             temp64.val32.lower;
1178                                         c->SG[i].Addr.upper =
1179                                             temp64.val32.upper;
1180                                         c->SG[i].Len = buff_size[i];
1181                                         c->SG[i].Ext = 0;       /* we are not chaining */
1182                                 }
1183                         }
1184                         c->waiting = &wait;
1185                         /* Put the request on the tail of the request queue */
1186                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1187                         addQ(&host->reqQ, c);
1188                         host->Qdepth++;
1189                         start_io(host);
1190                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1191                         wait_for_completion(&wait);
1192                         /* unlock the buffers from DMA */
1193                         for (i = 0; i < sg_used; i++) {
1194                                 temp64.val32.lower = c->SG[i].Addr.lower;
1195                                 temp64.val32.upper = c->SG[i].Addr.upper;
1196                                 pci_unmap_single(host->pdev,
1197                                         (dma_addr_t) temp64.val, buff_size[i],
1198                                         PCI_DMA_BIDIRECTIONAL);
1199                         }
1200                         /* Copy the error information out */
1201                         ioc->error_info = *(c->err_info);
1202                         if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1203                                 cmd_free(host, c, 0);
1204                                 status = -EFAULT;
1205                                 goto cleanup1;
1206                         }
1207                         if (ioc->Request.Type.Direction == XFER_READ) {
1208                                 /* Copy the data out of the buffer we created */
1209                                 BYTE __user *ptr = ioc->buf;
1210                                 for (i = 0; i < sg_used; i++) {
1211                                         if (copy_to_user
1212                                             (ptr, buff[i], buff_size[i])) {
1213                                                 cmd_free(host, c, 0);
1214                                                 status = -EFAULT;
1215                                                 goto cleanup1;
1216                                         }
1217                                         ptr += buff_size[i];
1218                                 }
1219                         }
1220                         cmd_free(host, c, 0);
1221                         status = 0;
1222                       cleanup1:
1223                         if (buff) {
1224                                 for (i = 0; i < sg_used; i++)
1225                                         kfree(buff[i]);
1226                                 kfree(buff);
1227                         }
1228                         kfree(buff_size);
1229                         kfree(ioc);
1230                         return status;
1231                 }
1232 
1233         /* scsi_cmd_ioctl handles these, below, though some are not
1234          * very meaningful for cciss.  SG_IO is the main one people want.
1235          */
1236 
1237         case SG_GET_VERSION_NUM:
1238         case SG_SET_TIMEOUT:
1239         case SG_GET_TIMEOUT:
1240         case SG_GET_RESERVED_SIZE:
1241         case SG_SET_RESERVED_SIZE:
1242         case SG_EMULATED_HOST:
1243         case SG_IO:
1244         case SCSI_IOCTL_SEND_COMMAND:
1245                 return scsi_cmd_ioctl(filep, disk, cmd, argp);
1246 
1247         /* scsi_cmd_ioctl would normally handle these, below, but
1248          * they aren't a good fit for cciss, as CD-ROMs are
1249          * not supported, and we don't have any bus/target/lun
1250          * which we present to the kernel.
1251          */
1252 
1253         case CDROM_SEND_PACKET:
1254         case CDROMCLOSETRAY:
1255         case CDROMEJECT:
1256         case SCSI_IOCTL_GET_IDLUN:
1257         case SCSI_IOCTL_GET_BUS_NUMBER:
1258         default:
1259                 return -ENOTTY;
1260         }
1261 }
1262 
1263 static inline void complete_buffers(struct bio *bio, int status)
1264 {
1265         while (bio) {
1266                 struct bio *xbh = bio->bi_next;
1267                 int nr_sectors = bio_sectors(bio);
1268 
1269                 bio->bi_next = NULL;
1270                 blk_finished_io(len);
1271                 bio_endio(bio, nr_sectors << 9, status);
1272                 bio = xbh;
1273         }
1274 }
1275 
1276 static void cciss_check_queues(ctlr_info_t *h)
1277 {
1278         int start_queue = h->next_to_run;
1279         int i;
1280 
1281         /* check to see if we have maxed out the number of commands that can
1282          * be placed on the queue.  If so then exit.  We do this check here
1283          * in case the interrupt we serviced was from an ioctl and did not
1284          * free any new commands.
1285          */
1286         if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1287                 return;
1288 
1289         /* We have room on the queue for more commands.  Now we need to queue
1290          * them up.  We will also keep track of the next queue to run so
1291          * that every queue gets a chance to be started first.
1292          */
1293         for (i = 0; i < h->highest_lun + 1; i++) {
1294                 int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1295                 /* make sure the disk has been added and the drive is real
1296                  * because this can be called from the middle of init_one.
1297                  */
1298                 if (!(h->drv[curr_queue].queue) ||
1299                     !(h->drv[curr_queue].heads) ||
1300                     h->drv[curr_queue].busy_configuring)
1301                         continue;
1302 
1303                 blk_start_queue(h->gendisk[curr_queue]->queue);
1304 
1305                 /* check to see if we have maxed out the number of commands
1306                  * that can be placed on the queue.
1307                  */
1308                 if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1309                         if (curr_queue == start_queue) {
1310                                 h->next_to_run =
1311                                     (start_queue + 1) % (h->highest_lun + 1);
1312                                 break;
1313                         } else {
1314                                 h->next_to_run = curr_queue;
1315                                 break;
1316                         }
1317                 } else {
1318                         curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
1319                 }
1320         }
1321 }
1322 
1323 static void cciss_softirq_done(struct request *rq)
1324 {
1325         CommandList_struct *cmd = rq->completion_data;
1326         ctlr_info_t *h = hba[cmd->ctlr];
1327         unsigned long flags;
1328         u64bit temp64;
1329         int i, ddir;
1330 
1331         if (cmd->Request.Type.Direction == XFER_READ)
1332                 ddir = PCI_DMA_FROMDEVICE;
1333         else
1334                 ddir = PCI_DMA_TODEVICE;
1335 
1336         /* command did not need to be retried */
1337         /* unmap the DMA mapping for all the scatter gather elements */
1338         for (i = 0; i < cmd->Header.SGList; i++) {
1339                 temp64.val32.lower = cmd->SG[i].Addr.lower;
1340                 temp64.val32.upper = cmd->SG[i].Addr.upper;
1341                 pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
1342         }
1343 
1344         complete_buffers(rq->bio, rq->errors);
1345 
1346         if (blk_fs_request(rq)) {
1347                 const int rw = rq_data_dir(rq);
1348 
1349                 all_stat_add(rq->rq_disk, sectors[rw],
1350                              rq->nr_sectors, rq->sector);
1351         }
1352 
1353 #ifdef CCISS_DEBUG
1354         printk("Done with %p\n", rq);
1355 #endif                          /* CCISS_DEBUG */
1356 
1357         add_disk_randomness(rq->rq_disk);
1358         spin_lock_irqsave(&h->lock, flags);
1359         end_that_request_last(rq, rq->errors);
1360         cmd_free(h, cmd, 1);
1361         cciss_check_queues(h);
1362         spin_unlock_irqrestore(&h->lock, flags);
1363 }
1364 
1365 /* This function will check the usage_count of the drive to be updated/added.
1366  * If the usage_count is zero then the drive information will be updated and
1367  * the disk will be re-registered with the kernel.  If not then it will be
1368  * left alone for the next reboot.  The exception to this is disk 0 which
1369  * will always be left registered with the kernel since it is also the
1370  * controller node.  Any changes to disk 0 will show up on the next
1371  * reboot.
1372  */
1373 static void cciss_update_drive_info(int ctlr, int drv_index)
1374 {
1375         ctlr_info_t *h = hba[ctlr];
1376         struct gendisk *disk;
1377         InquiryData_struct *inq_buff = NULL;
1378         unsigned int block_size;
1379         sector_t total_size;
1380         unsigned long flags = 0;
1381         int ret = 0;
1382 
1383         /* if the disk already exists then deregister it before proceeding */
1384         if (h->drv[drv_index].raid_level != -1) {
1385                 spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1386                 h->drv[drv_index].busy_configuring = 1;
1387                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1388 
1389                 /* deregister_disk sets h->drv[drv_index].queue = NULL */
1390                 /* which keeps the interrupt handler from starting */
1391                 /* the queue. */
1392                 ret = deregister_disk(h->gendisk[drv_index],
1393                                       &h->drv[drv_index], 0);
1394                 h->drv[drv_index].busy_configuring = 0;
1395         }
1396 
1397         /* If the disk is in use return */
1398         if (ret)
1399                 return;
1400 
1401         /* Get information about the disk and modify the driver structure */
1402         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1403         if (inq_buff == NULL)
1404                 goto mem_msg;
1405 
1406         /* testing to see if 16-byte CDBs are already being used */
1407         if (h->cciss_read == CCISS_READ_16) {
1408                 cciss_read_capacity_16(h->ctlr, drv_index, 1,
1409                                        &total_size, &block_size);
1410                 goto geo_inq;
1411         }
1412 
1413         cciss_read_capacity(ctlr, drv_index, 1, 
1414                             &total_size, &block_size);
1415 
1416         /* If read_capacity returns all F's the logical is >2TB in size */
1417         /* so we switch to 16-byte CDBs for all read/write ops */
1418         if (total_size == 0xFFFFFFFFULL) {
1419                 cciss_read_capacity_16(ctlr, drv_index, 1,
1420                                        &total_size, &block_size);
1421                 h->cciss_read = CCISS_READ_16;
1422                 h->cciss_write = CCISS_WRITE_16;
1423         } else {
1424                 h->cciss_read = CCISS_READ_10;
1425                 h->cciss_write = CCISS_WRITE_10;
1426         }
1427 geo_inq:
1428         cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
1429                                inq_buff, &h->drv[drv_index]);
1430 
1431         ++h->num_luns;
1432         disk = h->gendisk[drv_index];
1433         set_capacity(disk, h->drv[drv_index].nr_blocks);
1434 
1435         /* if it's the controller it's already added */
1436         if (drv_index) {
1437                 disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1438                 sprintf(disk->disk_name, "cciss/c%dd%d", ctlr, drv_index);
1439                 disk->major = h->major;
1440                 disk->first_minor = drv_index << NWD_SHIFT;
1441                 disk->fops = &cciss_fops;
1442                 disk->private_data = &h->drv[drv_index];
1443 
1444                 /* Set up queue information */
1445                 blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
1446 
1447                 /* This is a hardware imposed limit. */
1448                 blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
1449 
1450                 /* This is a limit in the driver and could be eliminated. */
1451                 blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
1452 
1453                 blk_queue_max_sectors(disk->queue, h->cciss_sector_size);
1454 
1455                 blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1456 
1457                 disk->queue->queuedata = hba[ctlr];
1458 
1459                 blk_queue_hardsect_size(disk->queue,
1460                                         hba[ctlr]->drv[drv_index].block_size);
1461 
1462                 /* Make sure all queue data is written out before */
1463                 /* setting h->drv[drv_index].queue, as setting this */
1464                 /* allows the interrupt handler to start the queue */
1465                 wmb();
1466                 h->drv[drv_index].queue = disk->queue;
1467                 add_disk(disk);
1468         }
1469 
1470       freeret:
1471         kfree(inq_buff);
1472         return;
1473       mem_msg:
1474         printk(KERN_ERR "cciss: out of memory\n");
1475         goto freeret;
1476 }
1477 
1478 /* This function will find the first index of the controllers drive array
1479  * that has a -1 for the raid_level and will return that index.  This is
1480  * where new drives will be added.  If the index to be returned is greater
1481  * than the highest_lun index for the controller then highest_lun is set
1482  * to this new index.  If there are no available indexes then -1 is returned.
1483  */
1484 static int cciss_find_free_drive_index(int ctlr)
1485 {
1486         int i;
1487 
1488         for (i = 0; i < CISS_MAX_LUN; i++) {
1489                 if (hba[ctlr]->drv[i].raid_level == -1) {
1490                         if (i > hba[ctlr]->highest_lun)
1491                                 hba[ctlr]->highest_lun = i;
1492                         return i;
1493                 }
1494         }
1495         return -1;
1496 }
1497 
1498 /* This function will add and remove logical drives from the Logical
1499  * drive array of the controller and maintain persistency of ordering
1500  * so that mount points are preserved until the next reboot.  This allows
1501  * for the removal of logical drives in the middle of the drive array
1502  * without a re-ordering of those drives.
1503  * INPUT
1504  * h            = The controller to perform the operations on
1505  * del_disk     = The disk to remove if specified.  If the value given
1506  *                is NULL then no disk is removed.
1507  */
1508 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
1509 {
1510         int ctlr = h->ctlr;
1511         int num_luns;
1512         ReportLunData_struct *ld_buff = NULL;
1513         drive_info_struct *drv = NULL;
1514         int return_code;
1515         int listlength = 0;
1516         int i;
1517         int drv_found;
1518         int drv_index = 0;
1519         __u32 lunid = 0;
1520         unsigned long flags;
1521 
1522         /* Set busy_configuring flag for this operation */
1523         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1524         if (h->busy_configuring) {
1525                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1526                 return -EBUSY;
1527         }
1528         h->busy_configuring = 1;
1529 
1530         /* if del_disk is NULL then we are being called to add a new disk
1531          * and update the logical drive table.  If it is not NULL then
1532          * we will check if the disk is in use or not.
1533          */
1534         if (del_disk != NULL) {
1535                 drv = get_drv(del_disk);
1536                 drv->busy_configuring = 1;
1537                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1538                 return_code = deregister_disk(del_disk, drv, 1);
1539                 drv->busy_configuring = 0;
1540                 h->busy_configuring = 0;
1541                 return return_code;
1542         } else {
1543                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1544                 if (!capable(CAP_SYS_RAWIO))
1545                         return -EPERM;
1546 
1547                 ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
1548                 if (ld_buff == NULL)
1549                         goto mem_msg;
1550 
1551                 return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
1552                                               sizeof(ReportLunData_struct), 0,
1553                                               0, 0, TYPE_CMD);
1554 
1555                 if (return_code == IO_OK) {
1556                         listlength =
1557                                 be32_to_cpu(*(__u32 *) ld_buff->LUNListLength);
1558                 } else {        /* reading number of logical volumes failed */
1559                         printk(KERN_WARNING "cciss: report logical volume"
1560                                " command failed\n");
1561                         listlength = 0;
1562                         goto freeret;
1563                 }
1564 
1565                 num_luns = listlength / 8;      /* 8 bytes per entry */
1566                 if (num_luns > CISS_MAX_LUN) {
1567                         num_luns = CISS_MAX_LUN;
1568                         printk(KERN_WARNING "cciss: more luns configured"
1569                                " on controller than can be handled by"
1570                                " this driver.\n");
1571                 }
1572 
1573                 /* Compare controller drive array to drivers drive array.
1574                  * Check for updates in the drive information and any new drives
1575                  * on the controller.
1576                  */
1577                 for (i = 0; i < num_luns; i++) {
1578                         int j;
1579 
1580                         drv_found = 0;
1581 
1582                         lunid = (0xff &
1583                                  (unsigned int)(ld_buff->LUN[i][3])) << 24;
1584                         lunid |= (0xff &
1585                                   (unsigned int)(ld_buff->LUN[i][2])) << 16;
1586                         lunid |= (0xff &
1587                                   (unsigned int)(ld_buff->LUN[i][1])) << 8;
1588                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
1589 
1590                         /* Find if the LUN is already in the drive array
1591                          * of the controller.  If so then update its info
1592                          * if not is use.  If it does not exist then find
1593                          * the first free index and add it.
1594                          */
1595                         for (j = 0; j <= h->highest_lun; j++) {
1596                                 if (h->drv[j].LunID == lunid) {
1597                                         drv_index = j;
1598                                         drv_found = 1;
1599                                 }
1600                         }
1601 
1602                         /* check if the drive was found already in the array */
1603                         if (!drv_found) {
1604                                 drv_index = cciss_find_free_drive_index(ctlr);
1605                                 if (drv_index == -1)
1606                                         goto freeret;
1607 
1608                                 /*Check if the gendisk needs to be allocated */
1609                                 if (!h->gendisk[drv_index]){
1610                                         h->gendisk[drv_index] = alloc_disk(1 << NWD_SHIFT);
1611                                         if (!h->gendisk[drv_index]){
1612                                                 printk(KERN_ERR "cciss: could not allocate new disk %d\n", drv_index);
1613                                                 goto mem_msg;
1614                                         }
1615                                 }
1616                         }
1617                         h->drv[drv_index].LunID = lunid;
1618                         cciss_update_drive_info(ctlr, drv_index);
1619                 }               /* end for */
1620         }                       /* end else */
1621 
1622       freeret:
1623         kfree(ld_buff);
1624         h->busy_configuring = 0;
1625         /* We return -1 here to tell the ACU that we have registered/updated
1626          * all of the drives that we can and to keep it from calling us
1627          * additional times.
1628          */
1629         return -1;
1630       mem_msg:
1631         printk(KERN_ERR "cciss: out of memory\n");
1632         goto freeret;
1633 }
1634 
1635 /* This function will deregister the disk and it's queue from the
1636  * kernel.  It must be called with the controller lock held and the
1637  * drv structures busy_configuring flag set.  It's parameters are:
1638  *
1639  * disk = This is the disk to be deregistered
1640  * drv  = This is the drive_info_struct associated with the disk to be
1641  *        deregistered.  It contains information about the disk used
1642  *        by the driver.
1643  * clear_all = This flag determines whether or not the disk information
1644  *             is going to be completely cleared out and the highest_lun
1645  *             reset.  Sometimes we want to clear out information about
1646  *             the disk in preparation for re-adding it.  In this case
1647  *             the highest_lun should be left unchanged and the LunID
1648  *             should not be cleared.
1649 */
1650 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
1651                            int clear_all)
1652 {
1653         int i;
1654         ctlr_info_t *h = get_host(disk);
1655 
1656         if (!capable(CAP_SYS_RAWIO))
1657                 return -EPERM;
1658 
1659         /* make sure logical volume is NOT is use */
1660         if (clear_all || (h->gendisk[0] == disk)) {
1661                 if (drv->usage_count > 1)
1662                         return -EBUSY;
1663         } else if (drv->usage_count > 0)
1664                 return -EBUSY;
1665 
1666         /* invalidate the devices and deregister the disk.  If it is disk
1667          * zero do not deregister it but just zero out it's values.  This
1668          * allows us to delete disk zero but keep the controller registered.
1669          */
1670         if (h->gendisk[0] != disk) {
1671                 if (disk) {
1672                         request_queue_t *q = disk->queue;
1673                         if (disk->flags & GENHD_FL_UP)
1674                                 del_gendisk(disk);
1675                         if (q) {
1676                                 blk_cleanup_queue(q);
1677                                 /* Set drv->queue to NULL so that we do not try
1678                                  * to call blk_start_queue on this queue in the
1679                                  * interrupt handler
1680                                  */
1681                                 drv->queue = NULL;
1682                         }
1683                         /* If clear_all is set then we are deleting the logical
1684                          * drive, not just refreshing its info.  For drives
1685                          * other than disk 0 we will call put_disk.  We do not
1686                          * do this for disk 0 as we need it to be able to
1687                          * configure the controller.
1688                         */
1689                         if (clear_all){
1690                                 /* This isn't pretty, but we need to find the
1691                                  * disk in our array and NULL our the pointer.
1692                                  * This is so that we will call alloc_disk if
1693                                  * this index is used again later.
1694                                 */
1695                                 for (i=0; i < CISS_MAX_LUN; i++){
1696                                         if(h->gendisk[i] == disk){
1697                                                 h->gendisk[i] = NULL;
1698                                                 break;
1699                                         }
1700                                 }
1701                                 put_disk(disk);
1702                         }
1703                 }
1704         } else {
1705                 set_capacity(disk, 0);
1706         }
1707 
1708         --h->num_luns;
1709         /* zero out the disk size info */
1710         drv->nr_blocks = 0;
1711         drv->block_size = 0;
1712         drv->heads = 0;
1713         drv->sectors = 0;
1714         drv->cylinders = 0;
1715         drv->raid_level = -1;   /* This can be used as a flag variable to
1716                                  * indicate that this element of the drive
1717                                  * array is free.
1718                                  */
1719 
1720         if (clear_all) {
1721                 /* check to see if it was the last disk */
1722                 if (drv == h->drv + h->highest_lun) {
1723                         /* if so, find the new hightest lun */
1724                         int i, newhighest = -1;
1725                         for (i = 0; i < h->highest_lun; i++) {
1726                                 /* if the disk has size > 0, it is available */
1727                                 if (h->drv[i].heads)
1728                                         newhighest = i;
1729                         }
1730                         h->highest_lun = newhighest;
1731                 }
1732 
1733                 drv->LunID = 0;
1734         }
1735         return 0;
1736 }
1737 
1738 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
1739                                                                                                                            1: address logical volume log_unit,
1740                                                                                                                            2: periph device address is scsi3addr */
1741                     unsigned int log_unit, __u8 page_code,
1742                     unsigned char *scsi3addr, int cmd_type)
1743 {
1744         ctlr_info_t *h = hba[ctlr];
1745         u64bit buff_dma_handle;
1746         int status = IO_OK;
1747 
1748         c->cmd_type = CMD_IOCTL_PEND;
1749         c->Header.ReplyQueue = 0;
1750         if (buff != NULL) {
1751                 c->Header.SGList = 1;
1752                 c->Header.SGTotal = 1;
1753         } else {
1754                 c->Header.SGList = 0;
1755                 c->Header.SGTotal = 0;
1756         }
1757         c->Header.Tag.lower = c->busaddr;
1758 
1759         c->Request.Type.Type = cmd_type;
1760         if (cmd_type == TYPE_CMD) {
1761                 switch (cmd) {
1762                 case CISS_INQUIRY:
1763                         /* If the logical unit number is 0 then, this is going
1764                            to controller so It's a physical command
1765                            mode = 0 target = 0.  So we have nothing to write.
1766                            otherwise, if use_unit_num == 1,
1767                            mode = 1(volume set addressing) target = LUNID
1768                            otherwise, if use_unit_num == 2,
1769                            mode = 0(periph dev addr) target = scsi3addr */
1770                         if (use_unit_num == 1) {
1771                                 c->Header.LUN.LogDev.VolId =
1772                                     h->drv[log_unit].LunID;
1773                                 c->Header.LUN.LogDev.Mode = 1;
1774                         } else if (use_unit_num == 2) {
1775                                 memcpy(c->Header.LUN.LunAddrBytes, scsi3addr,
1776                                        8);
1777                                 c->Header.LUN.LogDev.Mode = 0;
1778                         }
1779                         /* are we trying to read a vital product page */
1780                         if (page_code != 0) {
1781                                 c->Request.CDB[1] = 0x01;
1782                                 c->Request.CDB[2] = page_code;
1783                         }
1784                         c->Request.CDBLen = 6;
1785                         c->Request.Type.Attribute = ATTR_SIMPLE;
1786                         c->Request.Type.Direction = XFER_READ;
1787                         c->Request.Timeout = 0;
1788                         c->Request.CDB[0] = CISS_INQUIRY;
1789                         c->Request.CDB[4] = size & 0xFF;
1790                         break;
1791                 case CISS_REPORT_LOG:
1792                 case CISS_REPORT_PHYS:
1793                         /* Talking to controller so It's a physical command
1794                            mode = 00 target = 0.  Nothing to write.
1795                          */
1796                         c->Request.CDBLen = 12;
1797                         c->Request.Type.Attribute = ATTR_SIMPLE;
1798                         c->Request.Type.Direction = XFER_READ;
1799                         c->Request.Timeout = 0;
1800                         c->Request.CDB[0] = cmd;
1801                         c->Request.CDB[6] = (size >> 24) & 0xFF;        //MSB
1802                         c->Request.CDB[7] = (size >> 16) & 0xFF;
1803                         c->Request.CDB[8] = (size >> 8) & 0xFF;
1804                         c->Request.CDB[9] = size & 0xFF;
1805                         break;
1806 
1807                 case CCISS_READ_CAPACITY:
1808                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1809                         c->Header.LUN.LogDev.Mode = 1;
1810                         c->Request.CDBLen = 10;
1811                         c->Request.Type.Attribute = ATTR_SIMPLE;
1812                         c->Request.Type.Direction = XFER_READ;
1813                         c->Request.Timeout = 0;
1814                         c->Request.CDB[0] = cmd;
1815                         break;
1816                 case CCISS_READ_CAPACITY_16:
1817                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1818                         c->Header.LUN.LogDev.Mode = 1;
1819                         c->Request.CDBLen = 16;
1820                         c->Request.Type.Attribute = ATTR_SIMPLE;
1821                         c->Request.Type.Direction = XFER_READ;
1822                         c->Request.Timeout = 0;
1823                         c->Request.CDB[0] = cmd;
1824                         c->Request.CDB[1] = 0x10;
1825                         c->Request.CDB[10] = (size >> 24) & 0xFF;
1826                         c->Request.CDB[11] = (size >> 16) & 0xFF;
1827                         c->Request.CDB[12] = (size >> 8) & 0xFF;
1828                         c->Request.CDB[13] = size & 0xFF;
1829                         c->Request.Timeout = 0;
1830                         c->Request.CDB[0] = cmd;
1831                         break;
1832                 case CCISS_CACHE_FLUSH:
1833                         c->Request.CDBLen = 12;
1834                         c->Request.Type.Attribute = ATTR_SIMPLE;
1835                         c->Request.Type.Direction = XFER_WRITE;
1836                         c->Request.Timeout = 0;
1837                         c->Request.CDB[0] = BMIC_WRITE;
1838                         c->Request.CDB[6] = BMIC_CACHE_FLUSH;
1839                         break;
1840                 default:
1841                         printk(KERN_WARNING
1842                                "cciss%d:  Unknown Command 0x%c\n", ctlr, cmd);
1843                         return IO_ERROR;
1844                 }
1845         } else if (cmd_type == TYPE_MSG) {
1846                 switch (cmd) {
1847                 case 0: /* ABORT message */
1848                         c->Request.CDBLen = 12;
1849                         c->Request.Type.Attribute = ATTR_SIMPLE;
1850                         c->Request.Type.Direction = XFER_WRITE;
1851                         c->Request.Timeout = 0;
1852                         c->Request.CDB[0] = cmd;        /* abort */
1853                         c->Request.CDB[1] = 0;  /* abort a command */
1854                         /* buff contains the tag of the command to abort */
1855                         memcpy(&c->Request.CDB[4], buff, 8);
1856                         break;
1857                 case 1: /* RESET message */
1858                         c->Request.CDBLen = 12;
1859                         c->Request.Type.Attribute = ATTR_SIMPLE;
1860                         c->Request.Type.Direction = XFER_WRITE;
1861                         c->Request.Timeout = 0;
1862                         memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
1863                         c->Request.CDB[0] = cmd;        /* reset */
1864                         c->Request.CDB[1] = 0x04;       /* reset a LUN */
1865                         break;
1866                 case 3: /* No-Op message */
1867                         c->Request.CDBLen = 1;
1868                         c->Request.Type.Attribute = ATTR_SIMPLE;
1869                         c->Request.Type.Direction = XFER_WRITE;
1870                         c->Request.Timeout = 0;
1871                         c->Request.CDB[0] = cmd;
1872                         break;
1873                 default:
1874                         printk(KERN_WARNING
1875                                "cciss%d: unknown message type %d\n", ctlr, cmd);
1876                         return IO_ERROR;
1877                 }
1878         } else {
1879                 printk(KERN_WARNING
1880                        "cciss%d: unknown command type %d\n", ctlr, cmd_type);
1881                 return IO_ERROR;
1882         }
1883         /* Fill in the scatter gather information */
1884         if (size > 0) {
1885                 buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
1886                                                              buff, size,
1887                                                              PCI_DMA_BIDIRECTIONAL);
1888                 c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
1889                 c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
1890                 c->SG[0].Len = size;
1891                 c->SG[0].Ext = 0;       /* we are not chaining */
1892         }
1893         return status;
1894 }
1895 
1896 static int sendcmd_withirq(__u8 cmd,
1897                            int ctlr,
1898                            void *buff,
1899                            size_t size,
1900                            unsigned int use_unit_num,
1901                            unsigned int log_unit, __u8 page_code, int cmd_type)
1902 {
1903         ctlr_info_t *h = hba[ctlr];
1904         CommandList_struct *c;
1905         u64bit buff_dma_handle;
1906         unsigned long flags;
1907         int return_status;
1908         DECLARE_COMPLETION_ONSTACK(wait);
1909 
1910         if ((c = cmd_alloc(h, 0)) == NULL)
1911                 return -ENOMEM;
1912         return_status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
1913                                  log_unit, page_code, NULL, cmd_type);
1914         if (return_status != IO_OK) {
1915                 cmd_free(h, c, 0);
1916                 return return_status;
1917         }
1918       resend_cmd2:
1919         c->waiting = &wait;
1920 
1921         /* Put the request on the tail of the queue and send it */
1922         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1923         addQ(&h->reqQ, c);
1924         h->Qdepth++;
1925         start_io(h);
1926         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1927 
1928         wait_for_completion(&wait);
1929 
1930         if (c->err_info->CommandStatus != 0) {  /* an error has occurred */
1931                 switch (c->err_info->CommandStatus) {
1932                 case CMD_TARGET_STATUS:
1933                         printk(KERN_WARNING "cciss: cmd %p has "
1934                                " completed with errors\n", c);
1935                         if (c->err_info->ScsiStatus) {
1936                                 printk(KERN_WARNING "cciss: cmd %p "
1937                                        "has SCSI Status = %x\n",
1938                                        c, c->err_info->ScsiStatus);
1939                         }
1940 
1941                         break;
1942                 case CMD_DATA_UNDERRUN:
1943                 case CMD_DATA_OVERRUN:
1944                         /* expected for inquire and report lun commands */
1945                         break;
1946                 case CMD_INVALID:
1947                         printk(KERN_WARNING "cciss: Cmd %p is "
1948                                "reported invalid\n", c);
1949                         return_status = IO_ERROR;
1950                         break;
1951                 case CMD_PROTOCOL_ERR:
1952                         printk(KERN_WARNING "cciss: cmd %p has "
1953                                "protocol error \n", c);
1954                         return_status = IO_ERROR;
1955                         break;
1956                 case CMD_HARDWARE_ERR:
1957                         printk(KERN_WARNING "cciss: cmd %p had "
1958                                " hardware error\n", c);
1959                         return_status = IO_ERROR;
1960                         break;
1961                 case CMD_CONNECTION_LOST:
1962                         printk(KERN_WARNING "cciss: cmd %p had "
1963                                "connection lost\n", c);
1964                         return_status = IO_ERROR;
1965                         break;
1966                 case CMD_ABORTED:
1967                         printk(KERN_WARNING "cciss: cmd %p was "
1968                                "aborted\n", c);
1969                         return_status = IO_ERROR;
1970                         break;
1971                 case CMD_ABORT_FAILED:
1972                         printk(KERN_WARNING "cciss: cmd %p reports "
1973                                "abort failed\n", c);
1974                         return_status = IO_ERROR;
1975                         break;
1976                 case CMD_UNSOLICITED_ABORT:
1977                         printk(KERN_WARNING
1978                                "cciss%d: unsolicited abort %p\n", ctlr, c);
1979                         if (c->retry_count < MAX_CMD_RETRIES) {
1980                                 printk(KERN_WARNING
1981                                        "cciss%d: retrying %p\n", ctlr, c);
1982                                 c->retry_count++;
1983                                 /* erase the old error information */
1984                                 memset(c->err_info, 0,
1985                                        sizeof(ErrorInfo_struct));
1986                                 return_status = IO_OK;
1987                                 INIT_COMPLETION(wait);
1988                                 goto resend_cmd2;
1989                         }
1990                         return_status = IO_ERROR;
1991                         break;
1992                 default:
1993                         printk(KERN_WARNING "cciss: cmd %p returned "
1994                                "unknown status %x\n", c,
1995                                c->err_info->CommandStatus);
1996                         return_status = IO_ERROR;
1997                 }
1998         }
1999         /* unlock the buffers from DMA */
2000         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2001         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2002         pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
2003                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2004         cmd_free(h, c, 0);
2005         return return_status;
2006 }
2007 
2008 static void cciss_geometry_inquiry(int ctlr, int logvol,
2009                                    int withirq, sector_t total_size,
2010                                    unsigned int block_size,
2011                                    InquiryData_struct *inq_buff,
2012                                    drive_info_struct *drv)
2013 {
2014         int return_code;
2015         unsigned long t;
2016 
2017         memset(inq_buff, 0, sizeof(InquiryData_struct));
2018         if (withirq)
2019                 return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
2020                                               inq_buff, sizeof(*inq_buff), 1,
2021                                               logvol, 0xC1, TYPE_CMD);
2022         else
2023                 return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
2024                                       sizeof(*inq_buff), 1, logvol, 0xC1, NULL,
2025                                       TYPE_CMD);
2026         if (return_code == IO_OK) {
2027                 if (inq_buff->data_byte[8] == 0xFF) {
2028                         printk(KERN_WARNING
2029                                "cciss: reading geometry failed, volume "
2030                                "does not support reading geometry\n");
2031                         drv->heads = 255;
2032                         drv->sectors = 32;      /* Sectors per track */
2033                         drv->cylinders = total_size + 1;
2034                         drv->raid_level = RAID_UNKNOWN;
2035                 } else {
2036                         drv->heads = inq_buff->data_byte[6];
2037                         drv->sectors = inq_buff->data_byte[7];
2038                         drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
2039                         drv->cylinders += inq_buff->data_byte[5];
2040                         drv->raid_level = inq_buff->data_byte[8];
2041                 }
2042                 drv->block_size = block_size;
2043                 drv->nr_blocks = total_size + 1;
2044                 t = drv->heads * drv->sectors;
2045                 if(t > 1) {
2046                         sector_t real_size = total_size + 1;
2047                         unsigned long rem = sector_div(real_size, t);
2048                         if(rem)
2049                                 real_size++;
2050                         drv->cylinders = real_size;
2051                 }
2052         } else {                /* Get geometry failed */
2053                 printk(KERN_WARNING "cciss: reading geometry failed\n");
2054         }
2055         printk(KERN_INFO "      heads= %d, sectors= %d, cylinders= %d\n\n",
2056                drv->heads, drv->sectors, drv->cylinders);
2057 }
2058 
2059 static void
2060 cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
2061                                 unsigned int *block_size)
2062 {
2063         ReadCapdata_struct *buf;
2064         int return_code;
2065         buf = kmalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
2066         if (buf == NULL) {
2067                 printk(KERN_WARNING "cciss: out of memory\n");
2068                 return;
2069         }
2070         memset(buf, 0, sizeof(ReadCapdata_struct));
2071 
2072         if (withirq)
2073                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
2074                         ctlr, buf, sizeof(ReadCapdata_struct),
2075                                 1, logvol, 0, TYPE_CMD);
2076         else
2077                 return_code = sendcmd(CCISS_READ_CAPACITY,
2078                         ctlr, buf, sizeof(ReadCapdata_struct),
2079                                 1, logvol, 0, NULL, TYPE_CMD);
2080         if (return_code == IO_OK) {
2081                 *total_size = be32_to_cpu(*(__u32 *) buf->total_size);
2082                 *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
2083         } else { /* read capacity command failed */
2084                 printk(KERN_WARNING "cciss: read capacity failed\n");
2085                 *total_size = 0;
2086                 *block_size = BLOCK_SIZE;
2087         }
2088         if (*total_size != 0)
2089                 printk(KERN_INFO "      blocks= %lld block_size= %d\n",
2090                        (unsigned long long)*total_size+1, *block_size);
2091         kfree(buf);
2092         return;
2093 }
2094 
2095 static void
2096 cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,                                 unsigned int *block_size)
2097 {
2098         ReadCapdata_struct_16 *buf;
2099         int return_code;
2100         buf = kmalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
2101         if (buf == NULL) {
2102                 printk(KERN_WARNING "cciss: out of memory\n");
2103                 return;
2104         }
2105         memset(buf, 0, sizeof(ReadCapdata_struct_16));
2106         if (withirq) {
2107                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
2108                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2109                                 1, logvol, 0, TYPE_CMD);
2110         }
2111         else {
2112                 return_code = sendcmd(CCISS_READ_CAPACITY_16,
2113                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2114                                 1, logvol, 0, NULL, TYPE_CMD);
2115         }
2116         if (return_code == IO_OK) {
2117                 *total_size = be64_to_cpu(*(__u64 *) buf->total_size);
2118                 *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
2119         } else { /* read capacity command failed */
2120                 printk(KERN_WARNING "cciss: read capacity failed\n");
2121                 *total_size = 0;
2122                 *block_size = BLOCK_SIZE;
2123         }
2124         printk(KERN_INFO "      blocks= %lld block_size= %d\n",
2125                (unsigned long long)*total_size+1, *block_size);
2126         kfree(buf);
2127         return;
2128 }
2129 
2130 static int cciss_revalidate(struct gendisk *disk)
2131 {
2132         ctlr_info_t *h = get_host(disk);
2133         drive_info_struct *drv = get_drv(disk);
2134         int logvol;
2135         int FOUND = 0;
2136         unsigned int block_size;
2137         sector_t total_size;
2138         InquiryData_struct *inq_buff = NULL;
2139 
2140         for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2141                 if (h->drv[logvol].LunID == drv->LunID) {
2142                         FOUND = 1;
2143                         break;
2144                 }
2145         }
2146 
2147         if (!FOUND)
2148                 return 1;
2149 
2150         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2151         if (inq_buff == NULL) {
2152                 printk(KERN_WARNING "cciss: out of memory\n");
2153                 return 1;
2154         }
2155         if (h->cciss_read == CCISS_READ_10) {
2156                 cciss_read_capacity(h->ctlr, logvol, 1,
2157                                         &total_size, &block_size);
2158         } else {
2159                 cciss_read_capacity_16(h->ctlr, logvol, 1,
2160                                         &total_size, &block_size);
2161         }
2162         cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
2163                                         inq_buff, drv);
2164         blk_queue_hardsect_size(drv->queue, drv->block_size);
2165         set_capacity(disk, drv->nr_blocks);
2166 
2167         kfree(inq_buff);
2168         return 0;
2169 }
2170 
2171 /*
2172  *   Wait polling for a command to complete.
2173  *   The memory mapped FIFO is polled for the completion.
2174  *   Used only at init time, interrupts from the HBA are disabled.
2175  */
2176 static unsigned long pollcomplete(int ctlr)
2177 {
2178         unsigned long done;
2179         int i;
2180 
2181         /* Wait (up to 20 seconds) for a command to complete */
2182 
2183         for (i = 20 * HZ; i > 0; i--) {
2184                 done = hba[ctlr]->access.command_completed(hba[ctlr]);
2185                 if (done == FIFO_EMPTY)
2186                         schedule_timeout_uninterruptible(1);
2187                 else
2188                         return done;
2189         }
2190         /* Invalid address to tell caller we ran out of time */
2191         return 1;
2192 }
2193 
2194 static int add_sendcmd_reject(__u8 cmd, int ctlr, unsigned long complete)
2195 {
2196         /* We get in here if sendcmd() is polling for completions
2197            and gets some command back that it wasn't expecting --
2198            something other than that which it just sent down.
2199            Ordinarily, that shouldn't happen, but it can happen when
2200            the scsi tape stuff gets into error handling mode, and
2201            starts using sendcmd() to try to abort commands and
2202            reset tape drives.  In that case, sendcmd may pick up
2203            completions of commands that were sent to logical drives
2204            through the block i/o system, or cciss ioctls completing, etc.
2205            In that case, we need to save those completions for later
2206            processing by the interrupt handler.
2207          */
2208 
2209 #ifdef CONFIG_CISS_SCSI_TAPE
2210         struct sendcmd_reject_list *srl = &hba[ctlr]->scsi_rejects;
2211 
2212         /* If it's not the scsi tape stuff doing error handling, (abort */
2213         /* or reset) then we don't expect anything weird. */
2214         if (cmd != CCISS_RESET_MSG && cmd != CCISS_ABORT_MSG) {
2215 #endif
2216                 printk(KERN_WARNING "cciss cciss%d: SendCmd "
2217                        "Invalid command list address returned! (%lx)\n",
2218                        ctlr, complete);
2219                 /* not much we can do. */
2220 #ifdef CONFIG_CISS_SCSI_TAPE
2221                 /* We might get notification of completion of commands
2222                  * which we never issued in this kernel if this boot is
2223                  * taking place after previous kernel's crash. Simply
2224                  * ignore the commands in this case.
2225                  */
2226                 if (reset_devices)
2227                         return 0;
2228                 return 1;
2229         }
2230 
2231         /* We've sent down an abort or reset, but something else
2232            has completed */
2233         if (srl->ncompletions >= (hba[ctlr]->nr_cmds + 2)) {
2234                 /* Uh oh.  No room to save it for later... */
2235                 printk(KERN_WARNING "cciss%d: Sendcmd: Invalid command addr, "
2236                        "reject list overflow, command lost!\n", ctlr);
2237                 return 1;
2238         }
2239         /* Save it for later */
2240         srl->complete[srl->ncompletions] = complete;
2241         srl->ncompletions++;
2242 #endif
2243         return 0;
2244 }
2245 
2246 /*
2247  * Send a command to the controller, and wait for it to complete.
2248  * Only used at init time.
2249  */
2250 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
2251                                                                                                    1: address logical volume log_unit,
2252                                                                                                    2: periph device address is scsi3addr */
2253                    unsigned int log_unit,
2254                    __u8 page_code, unsigned char *scsi3addr, int cmd_type)
2255 {
2256         CommandList_struct *c;
2257         int i;
2258         unsigned long complete;
2259         ctlr_info_t *info_p = hba[ctlr];
2260         u64bit buff_dma_handle;
2261         int status, done = 0;
2262 
2263         if ((c = cmd_alloc(info_p, 1)) == NULL) {
2264                 printk(KERN_WARNING "cciss: unable to get memory");
2265                 return IO_ERROR;
2266         }
2267         status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
2268                           log_unit, page_code, scsi3addr, cmd_type);
2269         if (status != IO_OK) {
2270                 cmd_free(info_p, c, 1);
2271                 return status;
2272         }
2273       resend_cmd1:
2274         /*
2275          * Disable interrupt
2276          */
2277 #ifdef CCISS_DEBUG
2278         printk(KERN_DEBUG "cciss: turning intr off\n");
2279 #endif                          /* CCISS_DEBUG */
2280         info_p->access.set_intr_mask(info_p, CCISS_INTR_OFF);
2281 
2282         /* Make sure there is room in the command FIFO */
2283         /* Actually it should be completely empty at this time */
2284         /* unless we are in here doing error handling for the scsi */
2285         /* tape side of the driver. */
2286         for (i = 200000; i > 0; i--) {
2287                 /* if fifo isn't full go */
2288                 if (!(info_p->access.fifo_full(info_p))) {
2289 
2290                         break;
2291                 }
2292                 udelay(10);
2293                 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
2294                        " waiting!\n", ctlr);
2295         }
2296         /*
2297          * Send the cmd
2298          */
2299         info_p->access.submit_command(info_p, c);
2300         done = 0;
2301         do {
2302                 complete = pollcomplete(ctlr);
2303 
2304 #ifdef CCISS_DEBUG
2305                 printk(KERN_DEBUG "cciss: command completed\n");
2306 #endif                          /* CCISS_DEBUG */
2307 
2308                 if (complete == 1) {
2309                         printk(KERN_WARNING
2310                                "cciss cciss%d: SendCmd Timeout out, "
2311                                "No command list address returned!\n", ctlr);
2312                         status = IO_ERROR;
2313                         done = 1;
2314                         break;
2315                 }
2316 
2317                 /* This will need to change for direct lookup completions */
2318                 if ((complete & CISS_ERROR_BIT)
2319                     && (complete & ~CISS_ERROR_BIT) == c->busaddr) {
2320                         /* if data overrun or underun on Report command
2321                            ignore it
2322                          */
2323                         if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
2324                              (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
2325                              (c->Request.CDB[0] == CISS_INQUIRY)) &&
2326                             ((c->err_info->CommandStatus ==
2327                               CMD_DATA_OVERRUN) ||
2328                              (c->err_info->CommandStatus == CMD_DATA_UNDERRUN)
2329                             )) {
2330                                 complete = c->busaddr;
2331                         } else {
2332                                 if (c->err_info->CommandStatus ==
2333                                     CMD_UNSOLICITED_ABORT) {
2334                                         printk(KERN_WARNING "cciss%d: "
2335                                                "unsolicited abort %p\n",
2336                                                ctlr, c);
2337                                         if (c->retry_count < MAX_CMD_RETRIES) {
2338                                                 printk(KERN_WARNING
2339                                                        "cciss%d: retrying %p\n",
2340                                                        ctlr, c);
2341                                                 c->retry_count++;
2342                                                 /* erase the old error */
2343                                                 /* information */
2344                                                 memset(c->err_info, 0,
2345                                                        sizeof
2346                                                        (ErrorInfo_struct));
2347                                                 goto resend_cmd1;
2348                                         } else {
2349                                                 printk(KERN_WARNING
2350                                                        "cciss%d: retried %p too "
2351                                                        "many times\n", ctlr, c);
2352                                                 status = IO_ERROR;
2353                                                 goto cleanup1;
2354                                         }
2355                                 } else if (c->err_info->CommandStatus ==
2356                                            CMD_UNABORTABLE) {
2357                                         printk(KERN_WARNING
2358                                                "cciss%d: command could not be aborted.\n",
2359                                                ctlr);
2360                                         status = IO_ERROR;
2361                                         goto cleanup1;
2362                                 }
2363                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2364                                        " Error %x \n", ctlr,
2365                                        c->err_info->CommandStatus);
2366                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2367                                        " offensive info\n"
2368                                        "  size %x\n   num %x   value %x\n",
2369                                        ctlr,
2370                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2371                                        offense_size,
2372                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2373                                        offense_num,
2374                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2375                                        offense_value);
2376                                 status = IO_ERROR;
2377                                 goto cleanup1;
2378                         }
2379                 }
2380                 /* This will need changing for direct lookup completions */
2381                 if (complete != c->busaddr) {
2382                         if (add_sendcmd_reject(cmd, ctlr, complete) != 0) {
2383                                 BUG();  /* we are pretty much hosed if we get here. */
2384                         }
2385                         continue;
2386                 } else
2387                         done = 1;
2388         } while (!done);
2389 
2390       cleanup1:
2391         /* unlock the data buffer from DMA */
2392         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2393         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2394         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
2395                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2396 #ifdef CONFIG_CISS_SCSI_TAPE
2397         /* if we saved some commands for later, process them now. */
2398         if (info_p->scsi_rejects.ncompletions > 0)
2399                 do_cciss_intr(0, info_p, NULL);
2400 #endif
2401         cmd_free(info_p, c, 1);
2402         return status;
2403 }
2404 
2405 /*
2406  * Map (physical) PCI mem into (virtual) kernel space
2407  */
2408 static void __iomem *remap_pci_mem(ulong base, ulong size)
2409 {
2410         ulong page_base = ((ulong) base) & PAGE_MASK;
2411         ulong page_offs = ((ulong) base) - page_base;
2412         void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2413 
2414         return page_remapped ? (page_remapped + page_offs) : NULL;
2415 }
2416 
2417 /*
2418  * Takes jobs of the Q and sends them to the hardware, then puts it on
2419  * the Q to wait for completion.
2420  */
2421 static void start_io(ctlr_info_t *h)
2422 {
2423         CommandList_struct *c;
2424 
2425         while ((c = h->reqQ) != NULL) {
2426                 /* can't do anything if fifo is full */
2427                 if ((h->access.fifo_full(h))) {
2428                         printk(KERN_WARNING "cciss: fifo full\n");
2429                         break;
2430                 }
2431 
2432                 /* Get the first entry from the Request Q */
2433                 removeQ(&(h->reqQ), c);
2434                 h->Qdepth--;
2435 
2436                 /* Tell the controller execute command */
2437                 h->access.submit_command(h, c);
2438 
2439                 /* Put job onto the completed Q */
2440                 addQ(&(h->cmpQ), c);
2441         }
2442 }
2443 
2444 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
2445 /* Zeros out the error record and then resends the command back */
2446 /* to the controller */
2447 static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2448 {
2449         /* erase the old error information */
2450         memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2451 
2452         /* add it to software queue and then send it to the controller */
2453         addQ(&(h->reqQ), c);
2454         h->Qdepth++;
2455         if (h->Qdepth > h->maxQsinceinit)
2456                 h->maxQsinceinit = h->Qdepth;
2457 
2458         start_io(h);
2459 }
2460 
2461 static inline unsigned int make_status_bytes(unsigned int scsi_status_byte,
2462                         unsigned int msg_byte, unsigned int host_byte,
2463                         unsigned int driver_byte)
2464 {
2465         /* inverse of macros in scsi.h */
2466         return (scsi_status_byte & 0xff) |
2467                 ((msg_byte & 0xff) << 8) |
2468                 ((host_byte & 0xff) << 16) |
2469                 ((driver_byte & 0xff) << 24);
2470 }
2471 
2472 static inline int evaluate_target_status(CommandList_struct *cmd)
2473 {
2474         unsigned char sense_key;
2475         unsigned char status_byte, msg_byte, host_byte, driver_byte;
2476         int error_value;
2477 
2478         /* If we get in here, it means we got "target status", that is, scsi status */
2479         status_byte = cmd->err_info->ScsiStatus;
2480         driver_byte = DRIVER_OK;
2481         msg_byte = cmd->err_info->CommandStatus; /* correct?  seems too device specific */
2482 
2483         if (blk_pc_request(cmd->rq))
2484                 host_byte = DID_PASSTHROUGH;
2485         else
2486                 host_byte = DID_OK;
2487 
2488         error_value = make_status_bytes(status_byte, msg_byte,
2489                 host_byte, driver_byte);
2490 
2491         if (cmd->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION) {
2492                 if (!blk_pc_request(cmd->rq))
2493                         printk(KERN_WARNING "cciss: cmd %p "
2494                                "has SCSI Status 0x%x\n",
2495                                cmd, cmd->err_info->ScsiStatus);
2496                 return error_value;
2497         }
2498 
2499         /* check the sense key */
2500         sense_key = 0xf & cmd->err_info->SenseInfo[2];
2501         /* no status or recovered error */
2502         if (((sense_key == 0x0) || (sense_key == 0x1)) && !blk_pc_request(cmd->rq))
2503                 error_value = 0;
2504 
2505         if (!blk_pc_request(cmd->rq)) { /* Not SG_IO or similar? */
2506                 if (error_value != 0)
2507                         printk(KERN_WARNING "cciss: cmd %p has CHECK CONDITION"
2508                                " sense key = 0x%x\n", cmd, sense_key);
2509                 return error_value;
2510         }
2511 
2512         /* SG_IO or similar, copy sense data back */
2513         if (cmd->rq->sense) {
2514                 if (cmd->rq->sense_len > cmd->err_info->SenseLen)
2515                         cmd->rq->sense_len = cmd->err_info->SenseLen;
2516                 memcpy(cmd->rq->sense, cmd->err_info->SenseInfo,
2517                         cmd->rq->sense_len);
2518         } else
2519                 cmd->rq->sense_len = 0;
2520 
2521         return error_value;
2522 }
2523 
2524 /* checks the status of the job and calls complete buffers to mark all
2525  * buffers for the completed job. Note that this function does not need
2526  * to hold the hba/queue lock.
2527  */
2528 static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
2529                                     int timeout)
2530 {
2531         int retry_cmd = 0;
2532         struct request *rq = cmd->rq;
2533         int ctlr = h->ctlr;
2534 
2535         rq->errors = 0;
2536         if (timeout)
2537                 rq->errors = make_status_bytes(0, 0, 0, DRIVER_TIMEOUT);
2538 
2539         if (cmd->err_info->CommandStatus == 0)  /* no error has occurred */
2540                 goto after_error_processing;
2541 
2542         switch (cmd->err_info->CommandStatus) {
2543                 case CMD_TARGET_STATUS:
2544                         rq->errors = evaluate_target_status(cmd);
2545                         break;
2546                 case CMD_DATA_UNDERRUN:
2547                         if (blk_fs_request(cmd->rq))
2548                                 printk(KERN_WARNING "cciss: cmd %p has"
2549                                        " completed with data underrun "
2550                                        "reported\n", cmd);
2551                         break;
2552                 case CMD_DATA_OVERRUN:
2553                         if (blk_fs_request(cmd->rq))
2554                                 printk(KERN_WARNING "cciss: cmd %p has"
2555                                        " completed with data overrun "
2556                                        "reported\n", cmd);
2557                         break;
2558                 case CMD_INVALID:
2559                         printk(KERN_WARNING "cciss: cmd %p is "
2560                                "reported invalid\n", cmd);
2561                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2562                                 cmd->err_info->CommandStatus, DRIVER_OK,
2563                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH :
2564                                 DID_ERROR);
2565                         break;
2566                 case CMD_PROTOCOL_ERR:
2567                         printk(KERN_WARNING "cciss: cmd %p has "
2568                                "protocol error \n", cmd);
2569                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2570                                 cmd->err_info->CommandStatus, DRIVER_OK,
2571                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH :
2572                                 DID_ERROR);
2573                         break;
2574                 case CMD_HARDWARE_ERR:
2575                         printk(KERN_WARNING "cciss%d: cmd had "
2576                                " hardware error\n", ctlr);
2577                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2578                                 cmd->err_info->CommandStatus, DRIVER_OK,
2579                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH :
2580                                 DID_ERROR);
2581                         break;
2582                 case CMD_CONNECTION_LOST:
2583                         printk(KERN_WARNING "cciss%d: cmd had "
2584                                "connection lost\n", ctlr);
2585                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2586                                 cmd->err_info->CommandStatus, DRIVER_OK,
2587                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH :
2588                                 DID_ERROR);
2589                         break;
2590                 case CMD_ABORTED:
2591                         printk(KERN_WARNING "cciss%d: cmd was "
2592                                "aborted\n", ctlr);
2593                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2594                                 cmd->err_info->CommandStatus, DRIVER_OK,
2595                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH :
2596                                 DID_ABORT);
2597                         break;
2598                 case CMD_ABORT_FAILED:
2599                         printk(KERN_WARNING "cciss%d: cmd reports "
2600                                "abort failed\n", ctlr);
2601                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2602                                 cmd->err_info->CommandStatus, DRIVER_OK,
2603                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH :
2604                                 DID_ERROR);
2605                         break;
2606                 case CMD_UNSOLICITED_ABORT:
2607                         printk(KERN_WARNING "cciss%d: unsolicited "
2608                                "abort\n", ctlr);
2609                         if (cmd->retry_count < MAX_CMD_RETRIES) {
2610                                 retry_cmd = 1;
2611                                 printk(KERN_WARNING
2612                                        "cciss%d: retrying cmd\n", ctlr);
2613                                 cmd->retry_count++;
2614                         } else
2615                                 printk(KERN_WARNING
2616                                        "cciss%d: cmd retried too "
2617                                        "many times\n", ctlr);
2618                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2619                                 cmd->err_info->CommandStatus, DRIVER_OK,
2620                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
2621                         break;
2622                 case CMD_TIMEOUT:
2623                         printk(KERN_WARNING "cciss%d: cmd timedout\n", ctlr);
2624                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2625                                 cmd->err_info->CommandStatus, DRIVER_OK,
2626                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2627                         break;
2628                 default:
2629                         printk(KERN_WARNING "cciss%d: cmd returned "
2630                                "unknown status %x\n", ctlr,
2631                                cmd->err_info->CommandStatus);
2632                         rq->errors = make_status_bytes(SAM_STAT_GOOD,
2633                                 cmd->err_info->CommandStatus, DRIVER_OK,
2634                                 blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2635         }
2636 
2637 after_error_processing:
2638 
2639         /* We need to retry this command */
2640         if (retry_cmd) {
2641                 resend_cciss_cmd(h, cmd);
2642                 return;
2643         }
2644 
2645         cmd->rq->data_len = 0;
2646         cmd->rq->completion_data = cmd;
2647         blk_add_trace_rq(cmd->rq->q, cmd->rq, BLK_TA_COMPLETE);
2648         blk_complete_request(cmd->rq);
2649 }
2650 
2651 /*
2652  * Get a request and submit it to the controller.
2653  */
2654 static void do_cciss_request(request_queue_t *q)
2655 {
2656         ctlr_info_t *h = q->queuedata;
2657         CommandList_struct *c;
2658         sector_t start_blk;
2659         int seg;
2660         struct request *creq;
2661         u64bit temp64;
2662         struct scatterlist tmp_sg[MAXSGENTRIES];
2663         drive_info_struct *drv;
2664         int i, dir;
2665 
2666         /* We call start_io here in case there is a command waiting on the
2667          * queue that has not been sent.
2668          */
2669         if (blk_queue_plugged(q))
2670                 goto startio;
2671 
2672       queue:
2673         creq = elv_next_request(q);
2674         if (!creq)
2675                 goto startio;
2676 
2677         BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
2678 
2679         if ((c = cmd_alloc(h, 1)) == NULL)
2680                 goto full;
2681 
2682         blkdev_dequeue_request(creq);
2683 
2684         spin_unlock_irq(q->queue_lock);
2685 
2686         c->cmd_type = CMD_RWREQ;
2687         c->rq = creq;
2688 
2689         /* fill in the request */
2690         drv = creq->rq_disk->private_data;
2691         c->Header.ReplyQueue = 0;       // unused in simple mode
2692         /* got command from pool, so use the command block index instead */
2693         /* for direct lookups. */
2694         /* The first 2 bits are reserved for controller error reporting. */
2695         c->Header.Tag.lower = (c->cmdindex << 3);
2696         c->Header.Tag.lower |= 0x04;    /* flag for direct lookup. */
2697         c->Header.LUN.LogDev.VolId = drv->LunID;
2698         c->Header.LUN.LogDev.Mode = 1;
2699         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
2700         c->Request.Type.Type = TYPE_CMD;        // It is a command.
2701         c->Request.Type.Attribute = ATTR_SIMPLE;
2702         c->Request.Type.Direction =
2703             (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
2704         c->Request.Timeout = 0; // Don't time out
2705         c->Request.CDB[0] =
2706             (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
2707         start_blk = creq->sector;
2708 #ifdef CCISS_DEBUG
2709         printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n", (int)creq->sector,
2710                (int)creq->nr_sectors);
2711 #endif                          /* CCISS_DEBUG */
2712 
2713         seg = blk_rq_map_sg(q, creq, tmp_sg);
2714 
2715         /* get the DMA records for the setup */
2716         if (c->Request.Type.Direction == XFER_READ)
2717                 dir = PCI_DMA_FROMDEVICE;
2718         else
2719                 dir = PCI_DMA_TODEVICE;
2720 
2721         for (i = 0; i < seg; i++) {
2722                 c->SG[i].Len = tmp_sg[i].length;
2723                 temp64.val = (__u64) pci_map_page(h->pdev, tmp_sg[i].page,
2724                                                   tmp_sg[i].offset,
2725                                                   tmp_sg[i].length, dir);
2726                 c->SG[i].Addr.lower = temp64.val32.lower;
2727                 c->SG[i].Addr.upper = temp64.val32.upper;
2728                 c->SG[i].Ext = 0;       // we are not chaining
2729         }
2730         /* track how many SG entries we are using */
2731         if (seg > h->maxSG)
2732                 h->maxSG = seg;
2733 
2734 #ifdef CCISS_DEBUG
2735         printk(KERN_DEBUG "cciss: Submitting %d sectors in %d segments\n",
2736                creq->nr_sectors, seg);
2737 #endif                          /* CCISS_DEBUG */
2738 
2739         c->Header.SGList = c->Header.SGTotal = seg;
2740 
2741         if(likely(blk_fs_request(creq))) {
2742                 if(h->cciss_read == CCISS_READ_10) {
2743                         c->Request.CDB[1] = 0;
2744                         c->Request.CDB[2] = (start_blk >> 24) & 0xff;   //MSB
2745                         c->Request.CDB[3] = (start_blk >> 16) & 0xff;
2746                         c->Request.CDB[4] = (start_blk >> 8) & 0xff;
2747                         c->Request.CDB[5] = start_blk & 0xff;
2748                         c->Request.CDB[6] = 0;  // (sect >> 24) & 0xff; MSB
2749                         c->Request.CDB[7] = (creq->nr_sectors >> 8) & 0xff;
2750                         c->Request.CDB[8] = creq->nr_sectors & 0xff;
2751                         c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
2752                 } else {
2753                         c->Request.CDBLen = 16;
2754                         c->Request.CDB[1]= 0;
2755                         c->Request.CDB[2]= (start_blk >> 56) & 0xff;    //MSB
2756                         c->Request.CDB[3]= (start_blk >> 48) & 0xff;
2757                         c->Request.CDB[4]= (start_blk >> 40) & 0xff;
2758                         c->Request.CDB[5]= (start_blk >> 32) & 0xff;
2759                         c->Request.CDB[6]= (start_blk >> 24) & 0xff;
2760                         c->Request.CDB[7]= (start_blk >> 16) & 0xff;
2761                         c->Request.CDB[8]= (start_blk >>  8) & 0xff;
2762                         c->Request.CDB[9]= start_blk & 0xff;
2763                         c->Request.CDB[10]= (creq->nr_sectors >>  24) & 0xff;
2764                         c->Request.CDB[11]= (creq->nr_sectors >>  16) & 0xff;
2765                         c->Request.CDB[12]= (creq->nr_sectors >>  8) & 0xff;
2766                         c->Request.CDB[13]= creq->nr_sectors & 0xff;
2767                         c->Request.CDB[14] = c->Request.CDB[15] = 0;
2768                 }
2769         } else if (blk_pc_request(creq)) {
2770                 c->Request.CDBLen = creq->cmd_len;
2771                 memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
2772         } else {
2773                 printk(KERN_WARNING "cciss%d: bad request type %ld\n",
2774                                         h->ctlr, creq->flags);
2775                 BUG();
2776         }
2777         spin_lock_irq(q->queue_lock);
2778 
2779         addQ(&(h->reqQ), c);
2780         h->Qdepth++;
2781         if (h->Qdepth > h->maxQsinceinit)
2782                 h->maxQsinceinit = h->Qdepth;
2783 
2784         goto queue;
2785 full:
2786         blk_stop_queue(q);
2787 startio:
2788         /* We will already have the driver lock here so not need
2789          * to lock it.
2790          */
2791         start_io(h);
2792 }
2793 
2794 static inline unsigned long get_next_completion(ctlr_info_t *h)
2795 {
2796 #ifdef CONFIG_CISS_SCSI_TAPE
2797         /* Any rejects from sendcmd() lying around? Process them first */
2798         if (h->scsi_rejects.ncompletions == 0)
2799                 return h->access.command_completed(h);
2800         else {
2801                 struct sendcmd_reject_list *srl;
2802                 int n;
2803                 srl = &h->scsi_rejects;
2804                 n = --srl->ncompletions;
2805                 /* printk("cciss%d: processing saved reject\n", h->ctlr); */
2806                 printk("p");
2807                 return srl->complete[n];
2808         }
2809 #else
2810         return h->access.command_completed(h);
2811 #endif
2812 }
2813 
2814 static inline int interrupt_pending(ctlr_info_t *h)
2815 {
2816 #ifdef CONFIG_CISS_SCSI_TAPE
2817         return (h->access.intr_pending(h)
2818                 || (h->scsi_rejects.ncompletions > 0));
2819 #else
2820         return h->access.intr_pending(h);
2821 #endif
2822 }
2823 
2824 static inline long interrupt_not_for_us(ctlr_info_t *h)
2825 {
2826 #ifdef CONFIG_CISS_SCSI_TAPE
2827         return (((h->access.intr_pending(h) == 0) ||
2828                  (h->interrupts_enabled == 0))
2829                 && (h->scsi_rejects.ncompletions == 0));
2830 #else
2831         return (((h->access.intr_pending(h) == 0) ||
2832                  (h->interrupts_enabled == 0)));
2833 #endif
2834 }
2835 
2836 static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
2837 {
2838         ctlr_info_t *h = dev_id;
2839         CommandList_struct *c;
2840         unsigned long flags;
2841         __u32 a, a1, a2;
2842 
2843         if (interrupt_not_for_us(h))
2844                 return IRQ_NONE;
2845         /*
2846          * If there are completed commands in the completion queue,
2847          * we had better do something about it.
2848          */
2849         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2850         while (interrupt_pending(h)) {
2851                 while ((a = get_next_completion(h)) != FIFO_EMPTY) {
2852                         a1 = a;
2853                         if ((a & 0x04)) {
2854                                 a2 = (a >> 3);
2855                                 if (a2 >= h->nr_cmds) {
2856                                         printk(KERN_WARNING
2857                                                "cciss: controller cciss%d failed, stopping.\n",
2858                                                h->ctlr);
2859                                         fail_all_cmds(h->ctlr);
2860                                         return IRQ_HANDLED;
2861                                 }
2862 
2863                                 c = h->cmd_pool + a2;
2864                                 a = c->busaddr;
2865 
2866                         } else {
2867                                 a &= ~3;
2868                                 if ((c = h->cmpQ) == NULL) {
2869                                         printk(KERN_WARNING
2870                                                "cciss: Completion of %08x ignored\n",
2871                                                a1);
2872                                         continue;
2873                                 }
2874                                 while (c->busaddr != a) {
2875                                         c = c->next;
2876                                         if (c == h->cmpQ)
2877                                                 break;
2878                                 }
2879                         }
2880                         /*
2881                          * If we've found the command, take it off the
2882                          * completion Q and free it
2883                          */
2884                         if (c->busaddr == a) {
2885                                 removeQ(&h->cmpQ, c);
2886                                 if (c->cmd_type == CMD_RWREQ) {
2887                                         complete_command(h, c, 0);
2888                                 } else if (c->cmd_type == CMD_IOCTL_PEND) {
2889                                         complete(c->waiting);
2890                                 }
2891 #                               ifdef CONFIG_CISS_SCSI_TAPE
2892                                 else if (c->cmd_type == CMD_SCSI)
2893                                         complete_scsi_command(c, 0, a1);
2894 #                               endif
2895                                 continue;
2896                         }
2897                 }
2898         }
2899 
2900         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2901         return IRQ_HANDLED;
2902 }
2903 
2904 /*
2905  *  We cannot read the structure directly, for portability we must use
2906  *   the io functions.
2907  *   This is for debug only.
2908  */
2909 #ifdef CCISS_DEBUG
2910 static void print_cfg_table(CfgTable_struct *tb)
2911 {
2912         int i;
2913         char temp_name[17];
2914 
2915         printk("Controller Configuration information\n");
2916         printk("------------------------------------\n");
2917         for (i = 0; i < 4; i++)
2918                 temp_name[i] = readb(&(tb->Signature[i]));
2919         temp_name[4] = '\0';
2920         printk("   Signature = %s\n", temp_name);
2921         printk("   Spec Number = %d\n", readl(&(tb->SpecValence)));
2922         printk("   Transport methods supported = 0x%x\n",
2923                readl(&(tb->TransportSupport)));
2924         printk("   Transport methods active = 0x%x\n",
2925                readl(&(tb->TransportActive)));
2926         printk("   Requested transport Method = 0x%x\n",
2927                readl(&(tb->HostWrite.TransportRequest)));
2928         printk("   Coalesce Interrupt Delay = 0x%x\n",
2929                readl(&(tb->HostWrite.CoalIntDelay)));
2930         printk("   Coalesce Interrupt Count = 0x%x\n",
2931                readl(&(tb->HostWrite.CoalIntCount)));
2932         printk("   Max outstanding commands = 0x%d\n",
2933                readl(&(tb->CmdsOutMax)));
2934         printk("   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
2935         for (i = 0; i < 16; i++)
2936                 temp_name[i] = readb(&(tb->ServerName[i]));
2937         temp_name[16] = '\0';
2938         printk("   Server Name = %s\n", temp_name);
2939         printk("   Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
2940 }
2941 #endif                          /* CCISS_DEBUG */
2942 
2943 static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
2944 {
2945         int i, offset, mem_type, bar_type;
2946         if (pci_bar_addr == PCI_BASE_ADDRESS_0) /* looking for BAR zero? */
2947                 return 0;
2948         offset = 0;
2949         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
2950                 bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
2951                 if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
2952                         offset += 4;
2953                 else {
2954                         mem_type = pci_resource_flags(pdev, i) &
2955                             PCI_BASE_ADDRESS_MEM_TYPE_MASK;
2956                         switch (mem_type) {
2957                         case PCI_BASE_ADDRESS_MEM_TYPE_32:
2958                         case PCI_BASE_ADDRESS_MEM_TYPE_1M:
2959                                 offset += 4;    /* 32 bit */
2960                                 break;
2961                         case PCI_BASE_ADDRESS_MEM_TYPE_64:
2962                                 offset += 8;
2963                                 break;
2964                         default:        /* reserved in PCI 2.2 */
2965                                 printk(KERN_WARNING
2966                                        "Base address is invalid\n");
2967                                 return -1;
2968                                 break;
2969                         }
2970                 }
2971                 if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
2972                         return i + 1;
2973         }
2974         return -1;
2975 }
2976 
2977 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
2978  * controllers that are capable. If not, we use IO-APIC mode.
2979  */
2980 
2981 static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
2982                                            struct pci_dev *pdev, __u32 board_id)
2983 {
2984 #ifdef CONFIG_PCI_MSI
2985         int err;
2986         struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
2987         {0, 2}, {0, 3}
2988         };
2989 
2990         /* Some boards advertise MSI but don't really support it */
2991         if ((board_id == 0x40700E11) ||
2992             (board_id == 0x40800E11) ||
2993             (board_id == 0x40820E11) || (board_id == 0x40830E11))
2994                 goto default_int_mode;
2995 
2996         if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
2997                 err = pci_enable_msix(pdev, cciss_msix_entries, 4);
2998                 if (!err) {
2999                         c->intr[0] = cciss_msix_entries[0].vector;
3000                         c->intr[1] = cciss_msix_entries[1].vector;
3001                         c->intr[2] = cciss_msix_entries[2].vector;
3002                         c->intr[3] = cciss_msix_entries[3].vector;
3003                         c->msix_vector = 1;
3004                         return;
3005                 }
3006                 if (err > 0) {
3007                         printk(KERN_WARNING "cciss: only %d MSI-X vectors "
3008                                "available\n", err);
3009                         goto default_int_mode;
3010                 } else {
3011                         printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
3012                                err);
3013                         goto default_int_mode;
3014                 }
3015         }
3016         if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
3017                 if (!pci_enable_msi(pdev)) {
3018                         c->msi_vector = 1;
3019                 } else {
3020                         printk(KERN_WARNING "cciss: MSI init failed\n");
3021                 }
3022         }
3023 default_int_mode:
3024 #endif                          /* CONFIG_PCI_MSI */
3025         /* if we get here we're going to use the default interrupt mode */
3026         c->intr[SIMPLE_MODE_INT] = pdev->irq;
3027         return;
3028 }
3029 
3030 static int cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
3031 {
3032         ushort subsystem_vendor_id, subsystem_device_id, command;
3033         __u32 board_id, scratchpad = 0;
3034         __u64 cfg_offset;
3035         __u32 cfg_base_addr;
3036         __u64 cfg_base_addr_index;
3037         int i, err;
3038 
3039         /* check to see if controller has been disabled */
3040         /* BEFORE trying to enable it */
3041         (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
3042         if (!(command & 0x02)) {
3043                 printk(KERN_WARNING
3044                        "cciss: controller appears to be disabled\n");
3045                 return -ENODEV;
3046         }
3047 
3048         err = pci_enable_device(pdev);
3049         if (err) {
3050                 printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
3051                 return err;
3052         }
3053 
3054         err = pci_request_regions(pdev, "cciss");
3055         if (err) {
3056                 printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
3057                        "aborting\n");
3058                 return err;
3059         }
3060 
3061         subsystem_vendor_id = pdev->subsystem_vendor;
3062         subsystem_device_id = pdev->subsystem_device;
3063         board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
3064                     subsystem_vendor_id);
3065 
3066 #ifdef CCISS_DEBUG
3067         printk("command = %x\n", command);
3068         printk("irq = %x\n", pdev->irq);
3069         printk("board_id = %x\n", board_id);
3070 #endif                          /* CCISS_DEBUG */
3071 
3072 /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
3073  * else we use the IO-APIC interrupt assigned to us by system ROM.
3074  */
3075         cciss_interrupt_mode(c, pdev, board_id);
3076 
3077         /*
3078          * Memory base addr is first addr , the second points to the config
3079          *   table
3080          */
3081 
3082         c->paddr = pci_resource_start(pdev, 0); /* addressing mode bits already removed */
3083 #ifdef CCISS_DEBUG
3084         printk("address 0 = %x\n", c->paddr);
3085 #endif                          /* CCISS_DEBUG */
3086         c->vaddr = remap_pci_mem(c->paddr, 0x250);
3087 
3088         /* Wait for the board to become ready.  (PCI hotplug needs this.)
3089          * We poll for up to 120 secs, once per 100ms. */
3090         for (i = 0; i < 1200; i++) {
3091                 scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
3092                 if (scratchpad == CCISS_FIRMWARE_READY)
3093                         break;
3094                 set_current_state(TASK_INTERRUPTIBLE);
3095                 schedule_timeout(HZ / 10);      /* wait 100ms */
3096         }
3097         if (scratchpad != CCISS_FIRMWARE_READY) {
3098                 printk(KERN_WARNING "cciss: Board not ready.  Timed out.\n");
3099                 err = -ENODEV;
3100                 goto err_out_free_res;
3101         }
3102 
3103         /* get the address index number */
3104         cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
3105         cfg_base_addr &= (__u32) 0x0000ffff;
3106 #ifdef CCISS_DEBUG
3107         printk("cfg base address = %x\n", cfg_base_addr);
3108 #endif                          /* CCISS_DEBUG */
3109         cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
3110 #ifdef CCISS_DEBUG
3111         printk("cfg base address index = %x\n", cfg_base_addr_index);
3112 #endif                          /* CCISS_DEBUG */
3113         if (cfg_base_addr_index == -1) {
3114                 printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
3115                 err = -ENODEV;
3116                 goto err_out_free_res;
3117         }
3118 
3119         cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
3120 #ifdef CCISS_DEBUG
3121         printk("cfg offset = %x\n", cfg_offset);
3122 #endif                          /* CCISS_DEBUG */
3123         c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
3124                                                        cfg_base_addr_index) +
3125                                     cfg_offset, sizeof(CfgTable_struct));
3126         c->board_id = board_id;
3127 
3128 #ifdef CCISS_DEBUG
3129         print_cfg_table(c->cfgtable);
3130 #endif                          /* CCISS_DEBUG */
3131 
3132         /* Some controllers support Zero Memory Raid (ZMR).
3133          * When configured in ZMR mode the number of supported
3134          * commands drops to 64. So instead of just setting an
3135          * arbitrary value we make the driver a little smarter.
3136          * We read the config table to tell us how many commands
3137          * are supported on the controller then subtract 4 to
3138          * leave a little room for ioctl calls.
3139          */
3140         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3141         for (i = 0; i < ARRAY_SIZE(products); i++) {
3142                 if (board_id == products[i].board_id) {
3143                         c->product_name = products[i].product_name;
3144                         c->access = *(products[i].access);
3145                         c->nr_cmds = c->max_commands - 4;
3146                         break;
3147                 }
3148         }
3149         if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
3150             (readb(&c->cfgtable->Signature[1]) != 'I') ||
3151             (readb(&c->cfgtable->Signature[2]) != 'S') ||
3152             (readb(&c->cfgtable->Signature[3]) != 'S')) {
3153                 printk("Does not appear to be a valid CISS config table\n");
3154                 err = -ENODEV;
3155                 goto err_out_free_res;
3156         }
3157         /* We didn't find the controller in our list. We know the
3158          * signature is valid. If it's an HP device let's try to
3159          * bind to the device and fire it up. Otherwise we bail.
3160          */
3161         if (i == ARRAY_SIZE(products)) {
3162                 if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
3163                         c->product_name = products[i-1].product_name;
3164                         c->access = *(products[i-1].access);
3165                         c->nr_cmds = c->max_commands - 4;
3166                         printk(KERN_WARNING "cciss: This is an unknown "
3167                                 "Smart Array controller.\n");
3168                 } else {
3169                         printk(KERN_WARNING "cciss: Sorry, I don't know how"
3170                                 " to access the Smart Array controller %08lx\n"
3171                                         , (unsigned long)board_id);
3172                         err = -ENODEV;
3173                         goto err_out_free_res;
3174                 }
3175         }
3176 #ifdef CONFIG_X86
3177         {
3178                 /* Need to enable prefetch in the SCSI core for 6400 in x86 */
3179                 __u32 prefetch;
3180                 prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
3181                 prefetch |= 0x100;
3182                 writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
3183         }
3184 #endif
3185 
3186         /* Disabling DMA prefetch and refetch for the P600.
3187          * An ASIC bug may result in accesses to invalid memory addresses.
3188          * We've disabled prefetch for some time now. Testing with XEN
3189          * kernels revealed a bug in the refetch if dom0 resides on a P600.
3190          */
3191         if(board_id == 0x3225103C) {
3192                 __u32 dma_prefetch;
3193                 __u32 dma_refetch;
3194                 dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
3195                 dma_prefetch |= 0x8000;
3196                 writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
3197                 pci_read_config_dword(pdev, PCI_COMMAND_PARITY, &dma_refetch);
3198                 dma_refetch |= 0x1;
3199                 pci_write_config_dword(pdev, PCI_COMMAND_PARITY, dma_refetch);
3200         }
3201 
3202 #ifdef CCISS_DEBUG
3203         printk("Trying to put board into Simple mode\n");
3204 #endif                          /* CCISS_DEBUG */
3205         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3206         /* Update the field, and then ring the doorbell */
3207         writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
3208         writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
3209 
3210         /* under certain very rare conditions, this can take awhile.
3211          * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
3212          * as we enter this code.) */
3213         for (i = 0; i < MAX_CONFIG_WAIT; i++) {
3214                 if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
3215                         break;
3216                 /* delay and try again */
3217                 set_current_state(TASK_INTERRUPTIBLE);
3218                 schedule_timeout(10);
3219         }
3220 
3221 #ifdef CCISS_DEBUG
3222         printk(KERN_DEBUG "I counter got to %d %x\n", i,
3223                readl(c->vaddr + SA5_DOORBELL));
3224 #endif                          /* CCISS_DEBUG */
3225 #ifdef CCISS_DEBUG
3226         print_cfg_table(c->cfgtable);
3227 #endif                          /* CCISS_DEBUG */
3228 
3229         if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
3230                 printk(KERN_WARNING "cciss: unable to get board into"
3231                        " simple mode\n");
3232                 err = -ENODEV;
3233                 goto err_out_free_res;
3234         }
3235         return 0;
3236 
3237       err_out_free_res:
3238         /*
3239          * Deliberately omit pci_disable_device(): it does something nasty to
3240          * Smart Array controllers that pci_enable_device does not undo
3241          */
3242         pci_release_regions(pdev);
3243         return err;
3244 }
3245 
3246 /*
3247  * Gets information about the local volumes attached to the controller.
3248  */
3249 static void cciss_getgeometry(int cntl_num)
3250 {
3251         ReportLunData_struct *ld_buff;
3252         InquiryData_struct *inq_buff;
3253         int return_code;
3254         int i;
3255         int listlength = 0;
3256         __u32 lunid = 0;
3257         int block_size;
3258         sector_t total_size;
3259 
3260         ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
3261         if (ld_buff == NULL) {
3262                 printk(KERN_ERR "cciss: out of memory\n");
3263                 return;
3264         }
3265         inq_buff = kzalloc(sizeof( InquiryData_struct), GFP_KERNEL);
3266         if (inq_buff == NULL) {
3267                 printk(KERN_ERR "cciss: out of memory\n");
3268                 kfree(ld_buff);
3269                 return;
3270         }
3271         /* Get the firmware version */
3272         return_code = sendcmd(CISS_INQUIRY, cntl_num, inq_buff,
3273                               sizeof(InquiryData_struct), 0, 0, 0, NULL,
3274                               TYPE_CMD);
3275         if (return_code == IO_OK) {
3276                 hba[cntl_num]->firm_ver[0] = inq_buff->data_byte[32];
3277                 hba[cntl_num]->firm_ver[1] = inq_buff->data_byte[33];
3278                 hba[cntl_num]->firm_ver[2] = inq_buff->data_byte[34];
3279                 hba[cntl_num]->firm_ver[3] = inq_buff->data_byte[35];
3280         } else {                /* send command failed */
3281 
3282                 printk(KERN_WARNING "cciss: unable to determine firmware"
3283                        " version of controller\n");
3284         }
3285         /* Get the number of logical volumes */
3286         return_code = sendcmd(CISS_REPORT_LOG, cntl_num, ld_buff,
3287                               sizeof(ReportLunData_struct), 0, 0, 0, NULL,
3288                               TYPE_CMD);
3289 
3290         if (return_code == IO_OK) {
3291 #ifdef CCISS_DEBUG
3292                 printk("LUN Data\n--------------------------\n");
3293 #endif                          /* CCISS_DEBUG */
3294 
3295                 listlength |=
3296                     (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
3297                 listlength |=
3298                     (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
3299                 listlength |=
3300                     (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;
3301                 listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
3302         } else {                /* reading number of logical volumes failed */
3303 
3304                 printk(KERN_WARNING "cciss: report logical volume"
3305                        " command failed\n");
3306                 listlength = 0;
3307         }
3308         hba[cntl_num]->num_luns = listlength / 8;       // 8 bytes pre entry
3309         if (hba[cntl_num]->num_luns > CISS_MAX_LUN) {
3310                 printk(KERN_ERR
3311                        "ciss:  only %d number of logical volumes supported\n",
3312                        CISS_MAX_LUN);
3313                 hba[cntl_num]->num_luns = CISS_MAX_LUN;
3314         }
3315 #ifdef CCISS_DEBUG
3316         printk(KERN_DEBUG "Length = %x %x %x %x = %d\n",
3317                ld_buff->LUNListLength[0], ld_buff->LUNListLength[1],
3318                ld_buff->LUNListLength[2], ld_buff->LUNListLength[3],
3319                hba[cntl_num]->num_luns);
3320 #endif                          /* CCISS_DEBUG */
3321 
3322         hba[cntl_num]->highest_lun = hba[cntl_num]->num_luns - 1;
3323         for (i = 0; i < CISS_MAX_LUN; i++) {
3324                 if (i < hba[cntl_num]->num_luns) {
3325                         lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3]))
3326                             << 24;
3327                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2]))
3328                             << 16;
3329                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1]))
3330                             << 8;
3331                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
3332 
3333                         hba[cntl_num]->drv[i].LunID = lunid;
3334 
3335 #ifdef CCISS_DEBUG
3336                         printk(KERN_DEBUG "LUN[%d]:  %x %x %x %x = %x\n", i,
3337                                ld_buff->LUN[i][0], ld_buff->LUN[i][1],
3338                                ld_buff->LUN[i][2], ld_buff->LUN[i][3],
3339                                hba[cntl_num]->drv[i].LunID);
3340 #endif                          /* CCISS_DEBUG */
3341 
3342                 /* testing to see if 16-byte CDBs are already being used */
3343                 if(hba[cntl_num]->cciss_read == CCISS_READ_16) {
3344                         cciss_read_capacity_16(cntl_num, i, 0,
3345                         &total_size, &block_size);
3346                         goto geo_inq;
3347                 }
3348                 cciss_read_capacity(cntl_num, i, 0, &total_size, &block_size);
3349 
3350                 /* If read_capacity returns all F's the volume is >2TB */
3351                 /* so we switch to 16-byte CDBs for all read/write ops */
3352                 if(total_size == 0xFFFFFFFFULL) {
3353                         cciss_read_capacity_16(cntl_num, i, 0,
3354                                                &total_size, &block_size);
3355                         hba[cntl_num]->cciss_read = CCISS_READ_16;
3356                         hba[cntl_num]->cciss_write = CCISS_WRITE_16;
3357                 } else {
3358                         hba[cntl_num]->cciss_read = CCISS_READ_10;
3359                         hba[cntl_num]->cciss_write = CCISS_WRITE_10;
3360                 }
3361 geo_inq:
3362                         cciss_geometry_inquiry(cntl_num, i, 0, total_size,
3363                                                block_size, inq_buff,
3364                                                &hba[cntl_num]->drv[i]);
3365                 } else {
3366                         /* initialize raid_level to indicate a free space */
3367                         hba[cntl_num]->drv[i].raid_level = -1;
3368                 }
3369         }
3370         kfree(ld_buff);
3371         kfree(inq_buff);
3372 }
3373 
3374 /* Function to find the first free pointer into our hba[] array */
3375 /* Returns -1 if no free entries are left.  */
3376 static int alloc_cciss_hba(void)
3377 {
3378         int i;
3379 
3380         for (i = 0; i < MAX_CTLR; i++) {
3381                 if (!hba[i]) {
3382                         ctlr_info_t *p;
3383                         p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
3384                         if (!p)
3385                                 goto Enomem;
3386                         p->gendisk[0] = alloc_disk(1 << NWD_SHIFT);
3387                         if (!p->gendisk[0])
3388                                 goto Enomem;
3389                         hba[i] = p;
3390                         return i;
3391                 }
3392         }
3393         printk(KERN_WARNING "cciss: This driver supports a maximum"
3394                " of %d controllers.\n", MAX_CTLR);
3395         return -1;
3396 Enomem:
3397         printk(KERN_ERR "cciss: out of memory.\n");
3398         return -1;
3399 }
3400 
3401 static void free_hba(int i)
3402 {
3403         ctlr_info_t *p = hba[i];
3404         int n;
3405 
3406         hba[i] = NULL;
3407         for (n = 0; n < CISS_MAX_LUN; n++)
3408                 put_disk(p->gendisk[n]);
3409         kfree(p);
3410 }
3411 
3412 /* Send a message CDB to the firmware. */
3413 static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, unsigned char type)
3414 {
3415         typedef struct {
3416                 CommandListHeader_struct CommandHeader;
3417                 RequestBlock_struct Request;
3418                 ErrDescriptor_struct ErrorDescriptor;
3419         } Command;
3420         static const size_t cmd_sz = sizeof(Command) + sizeof(ErrorInfo_struct);
3421         Command *cmd;
3422         dma_addr_t paddr64;
3423         uint32_t paddr32, tag;
3424         void __iomem *vaddr;
3425         int i, err;
3426 
3427         vaddr = ioremap_nocache(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0));
3428         if (vaddr == NULL)
3429                 return -ENOMEM;
3430 
3431         /* The Inbound Post Queue only accepts 32-bit physical addresses for the
3432            CCISS commands, so they must be allocated from the lower 4GiB of
3433            memory. */
3434         err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
3435         if (err) {
3436                 iounmap(vaddr);
3437                 return -ENOMEM;
3438         }
3439 
3440         cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
3441         if (cmd == NULL) {
3442                 iounmap(vaddr);
3443                 return -ENOMEM;
3444         }
3445 
3446         /* This must fit, because of the 32-bit consistent DMA mask.  Also,
3447            although there's no guarantee, we assume that the address is at
3448            least 4-byte aligned (most likely, it's page-aligned). */
3449         paddr32 = paddr64;
3450 
3451         cmd->CommandHeader.ReplyQueue = 0;
3452         cmd->CommandHeader.SGList = 0;
3453         cmd->CommandHeader.SGTotal = 0;
3454         cmd->CommandHeader.Tag.lower = paddr32;
3455         cmd->CommandHeader.Tag.upper = 0;
3456         memset(&cmd->CommandHeader.LUN.LunAddrBytes, 0, 8);
3457 
3458         cmd->Request.CDBLen = 16;
3459         cmd->Request.Type.Type = TYPE_MSG;
3460         cmd->Request.Type.Attribute = ATTR_HEADOFQUEUE;
3461         cmd->Request.Type.Direction = XFER_NONE;
3462         cmd->Request.Timeout = 0; /* Don't time out */
3463         cmd->Request.CDB[0] = opcode;
3464         cmd->Request.CDB[1] = type;
3465         memset(&cmd->Request.CDB[2], 0, 14); /* the rest of the CDB is reserved */
3466 
3467         cmd->ErrorDescriptor.Addr.lower = paddr32 + sizeof(Command);
3468         cmd->ErrorDescriptor.Addr.upper = 0;
3469         cmd->ErrorDescriptor.Len = sizeof(ErrorInfo_struct);
3470 
3471         writel(paddr32, vaddr + SA5_REQUEST_PORT_OFFSET);
3472 
3473         for (i = 0; i < 10; i++) {
3474                 tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
3475                 if ((tag & ~3) == paddr32)
3476                         break;
3477                 schedule_timeout_uninterruptible(HZ);
3478         }
3479 
3480         iounmap(vaddr);
3481 
3482         /* we leak the DMA buffer here ... no choice since the controller could
3483            still complete the command. */
3484         if (i == 10) {
3485                 printk(KERN_ERR "cciss: controller message %02x:%02x timed out\n",
3486                         opcode, type);
3487                 return -ETIMEDOUT;
3488         }
3489 
3490         pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
3491 
3492         if (tag & 2) {
3493                 printk(KERN_ERR "cciss: controller message %02x:%02x failed\n",
3494                         opcode, type);
3495                 return -EIO;
3496         }
3497 
3498         printk(KERN_INFO "cciss: controller message %02x:%02x succeeded\n",
3499                 opcode, type);
3500         return 0;
3501 }
3502 
3503 #define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
3504 #define cciss_noop(p) cciss_message(p, 3, 0)
3505 
3506 static __devinit int cciss_reset_msi(struct pci_dev *pdev)
3507 {
3508 /* the #defines are stolen from drivers/pci/msi.h. */
3509 #define msi_control_reg(base)           (base + PCI_MSI_FLAGS)
3510 #define PCI_MSIX_FLAGS_ENABLE           (1 << 15)
3511 
3512         int pos;
3513         u16 control = 0;
3514 
3515         pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
3516         if (pos) {
3517                 pci_read_config_word(pdev, msi_control_reg(pos), &control);
3518                 if (control & PCI_MSI_FLAGS_ENABLE) {
3519                         printk(KERN_INFO "cciss: resetting MSI\n");
3520                         pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
3521                 }
3522         }
3523 
3524         pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
3525         if (pos) {
3526                 pci_read_config_word(pdev, msi_control_reg(pos), &control);
3527                 if (control & PCI_MSIX_FLAGS_ENABLE) {
3528                         printk(KERN_INFO "cciss: resetting MSI-X\n");
3529                         pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
3530                 }
3531         }
3532 
3533         return 0;
3534 }
3535 
3536 /* This does a hard reset of the controller using PCI power management
3537  * states. */
3538 static __devinit int cciss_hard_reset_controller(struct pci_dev *pdev)
3539 {
3540         u16 pmcsr, saved_config_space[32];
3541         int i, pos;
3542 
3543         printk(KERN_INFO "cciss: using PCI PM to reset controller\n");
3544 
3545         /* This is very nearly the same thing as
3546 
3547            pci_save_state(pci_dev);
3548            pci_set_power_state(pci_dev, PCI_D3hot);
3549            pci_set_power_state(pci_dev, PCI_D0);
3550            pci_restore_state(pci_dev);
3551 
3552            but we can't use these nice canned kernel routines on
3553            kexec, because they also check the MSI/MSI-X state in PCI
3554            configuration space and do the wrong thing when it is
3555            set/cleared.  Also, the pci_save/restore_state functions
3556            violate the ordering requirements for restoring the
3557            configuration space from the CCISS document (see the
3558            comment below).  So we roll our own .... */
3559 
3560         for (i = 0; i < 32; i++)
3561                 pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
3562 
3563         pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
3564         if (pos == 0) {
3565                 printk(KERN_ERR "cciss_reset_controller: PCI PM not supported\n");
3566                 return -ENODEV;
3567         }
3568 
3569         /* Quoting from the Open CISS Specification: "The Power
3570          * Management Control/Status Register (CSR) controls the power
3571          * state of the device.  The normal operating state is D0,
3572          * CSR=00h.  The software off state is D3, CSR=03h.  To reset
3573          * the controller, place the interface device in D3 then to
3574          * D0, this causes a secondary PCI reset which will reset the
3575          * controller." */
3576 
3577         /* enter the D3hot power management state */
3578         pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
3579         pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
3580         pmcsr |= PCI_D3hot;
3581         pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
3582 
3583         set_current_state(TASK_UNINTERRUPTIBLE);
3584         schedule_timeout(HZ >> 1);
3585 
3586         /* enter the D0 power management state */
3587         pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
3588         pmcsr |= PCI_D0;
3589         pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
3590 
3591         set_current_state(TASK_UNINTERRUPTIBLE);
3592         schedule_timeout(HZ >> 1);
3593 
3594         /* Restore the PCI configuration space.  The Open CISS
3595          * Specification says, "Restore the PCI Configuration
3596          * Registers, offsets 00h through 60h. It is important to
3597          * restore the command register, 16-bits at offset 04h,
3598          * last. Do not restore the configuration status register,
3599          * 16-bits at offset 06h."  Note that the offset is 2*i. */
3600         for (i = 0; i < 32; i++) {
3601                 if (i == 2 || i == 3)
3602                         continue;
3603                 pci_write_config_word(pdev, 2*i, saved_config_space[i]);
3604         }
3605         wmb();
3606         pci_write_config_word(pdev, 4, saved_config_space[2]);
3607 
3608         return 0;
3609 }
3610 
3611 /*
3612  *  This is it.  Find all the controllers and register them.  I really hate
3613  *  stealing all these major device numbers.
3614  *  returns the number of block devices registered.
3615  */
3616 static int __devinit cciss_init_one(struct pci_dev *pdev,
3617                                     const struct pci_device_id *ent)
3618 {
3619         int i;
3620         int j = 0;
3621         int rc;
3622         int dac;
3623 
3624         if (reset_devices) {
3625                 /* Reset the controller with a PCI power-cycle */
3626                 if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
3627                         return -ENODEV;
3628 
3629                 /* Some devices (notably the HP Smart Array 5i Controller)
3630                    need a little pause here */
3631                 schedule_timeout_uninterruptible(30*HZ);
3632 
3633                 /* Now try to get the controller to respond to a no-op */
3634                 for (i=0;